<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="notice" value="0.430017,0.791882,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="109.206.125.4"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,503,0 0 0 0 0 0 1 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="1.68.182.246"/>
        </slice>
        <from usec="0" sec="1252472671"/>
        <to usec="0" sec="1252472717"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="111.64.17.231" dst_port="53"/>
        </slice>
        <from usec="0" sec="1252472671"/>
        <to usec="0" sec="1252472717"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="51.73.119.234" src_port="80"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="144.40.158.33" src_port="53"/>
        </slice>
        <from usec="0" sec="1252472671"/>
        <to usec="0" sec="1252472717"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="144.40.159.7" src_port="53"/>
        </slice>
        <from usec="0" sec="1252472671"/>
        <to usec="0" sec="1252472717"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="168.92.84.211"/>
        </slice>
        <from usec="0" sec="1252472896"/>
        <to usec="0" sec="1252472942"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter dst_ip="174.164.197.214"/>
        </slice>
        <from usec="0" sec="1252472896"/>
        <to usec="0" sec="1252472942"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="202.208.129.249"/>
        </slice>
        <from usec="0" sec="1252472896"/>
        <to usec="0" sec="1252472942"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="206.121.118.147"/>
        </slice>
        <from usec="0" sec="1252473076"/>
        <to usec="0" sec="1252473122"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="51.73.119.234" src_port="80"/>
        </slice>
        <from usec="0" sec="1252472671"/>
        <to usec="0" sec="1252472717"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,020,0 0 0 0 0 0 1 0 0 0 0 0,hostout">
        <slice>
            <filter src_ip="168.76.205.150"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="168.76.71.107"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="174.164.131.141"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="206.121.107.25"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="206.121.106.47"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="168.76.138.73" dst_port="53"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="174.164.83.34" dst_port="53"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="174.164.202.146" dst_port="53"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="174.164.145.151" dst_port="53"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,503,0 0 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="174.164.156.35" dst_port="80"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="206.121.109.112" dst_port="53"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="168.76.99.136" dst_port="53"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,503,0 0 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="207.95.65.92" dst_port="80"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="149.51.2.66" dst_port="53"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,012,0 0 0 0 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="149.51.63.138" dst_ip="108.22.94.31" src_port="3128"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,012,0 0 0 0 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="149.51.63.132" dst_ip="108.22.94.31" src_port="3124"/>
        </slice>
        <from usec="0" sec="1252472941"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="206.121.106.148" src_port="10785"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,503,0 0 0 0 0 0 1 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="207.83.254.155" dst_port="80"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="168.76.127.20" src_port="25"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="168.76.127.20" dst_port="25"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,503,0 0 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="206.121.118.152" dst_port="80"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="108.22.94.31" dst_ip="149.51.63.133" dst_port="3128"/>
            <filter src_ip="108.22.94.31" dst_ip="149.51.63.138" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="174.164.225.12" src_port="21056"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="109.70.231.9" src_port="80"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="207.83.234.74" src_port="31983"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,002,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="206.121.106.137" src_port="137" dst_port="137"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_port="1653" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_port="3691" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_port="4600" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_port="4967" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1252473211"/>
        <to usec="0" sec="1252473257"/>
    </anomaly>
    <anomaly type="notice" value="0.430017,0.791882,503,0 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="172.248.243.136" dst_ip="206.121.101.72" dst_port="80"/>
        </slice>
        <from usec="0" sec="1252472401"/>
        <to usec="0" sec="1252472447"/>
    </anomaly>
</admd:annotation>
