<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.033580,2.033190,020,0 0 0 0 0 0 0 0 0 0 0 1,icmp_error">
        <slice>
            <filter dst_ip="57.174.20.224" dst_port="10023"/>
            <filter dst_ip="57.174.20.224"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.386120,1.382290,503,1 0 0 0 0 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="193.35.198.186" dst_port="80"/>
            <filter src_ip="193.35.198.186" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.040410,1.526500,999,1 0 0 1 1 1 1 1 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="130.71.167.0" src_port="56054"/>
            <filter src_ip="130.71.167.0"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.281410,1.727570,011,1 1 1 1 1 1 0 0 0 1 0 0,ntscTCPRSTrp">
        <slice>
            <filter dst_ip="89.88.211.132" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.910250,1.471820,503,0 0 0 1 1 1 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="193.43.137.194" dst_ip="223.141.140.225" src_port="53"/>
            <filter src_ip="193.43.158.50" dst_ip="223.141.140.225" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.214200,1.728440,010,1 1 1 1 1 1 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="89.97.122.159" src_port="6000" dst_port="9000"/>
            <filter src_ip="89.97.122.159" src_port="6000" dst_port="1080"/>
        </slice>
        <from usec="0" sec="1255151109"/>
        <to usec="0" sec="1255151514"/>
    </anomaly>
    <anomaly type="anomalous" value="1.816500,1.457720,504,1 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="176.239.242.6" dst_ip="39.210.65.79" src_port="443"/>
            <filter src_ip="176.239.184.225" dst_ip="39.210.65.79" src_port="443"/>
        </slice>
        <from usec="0" sec="1255150802"/>
        <to usec="0" sec="1255151538"/>
    </anomaly>
    <anomaly type="anomalous" value="2.148610,1.610390,503,0 0 0 1 1 1 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="176.239.117.43" dst_ip="9.26.208.73" src_port="80"/>
            <filter src_ip="176.239.253.128" dst_ip="35.137.229.109" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.214200,1.728440,010,1 1 1 1 1 1 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="95.76.86.133" src_port="6000" dst_port="8090"/>
        </slice>
        <from usec="0" sec="1255151493"/>
        <to usec="0" sec="1255151496"/>
    </anomaly>
    <anomaly type="anomalous" value="1.829470,1.472830,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="176.239.226.100" dst_ip="4.69.48.193" src_port="80"/>
        </slice>
        <from usec="0" sec="1255150828"/>
        <to usec="0" sec="1255151307"/>
    </anomaly>
    <anomaly type="anomalous" value="2.148610,1.610390,503,0 0 0 1 1 1 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="192.8.112.77" dst_ip="200.64.95.87"/>
            <filter src_ip="192.8.112.77" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.829470,1.472830,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="89.43.82.165" dst_ip="130.71.68.203" src_port="80" dst_port="1349"/>
        </slice>
        <from usec="0" sec="1255151116"/>
        <to usec="0" sec="1255151124"/>
    </anomaly>
    <anomaly type="anomalous" value="2.919610,2.324670,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="89.43.82.168" dst_ip="130.71.68.203" src_port="80" dst_port="1471"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.148610,1.610390,020,0 0 0 1 1 1 0 0 0 1 1 0,icmp_error">
        <slice>
            <filter dst_ip="57.174.20.224" dst_port="10023"/>
            <filter dst_ip="57.174.20.224"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.829470,1.472830,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="40.186.40.244" dst_ip="193.43.121.141" src_port="80"/>
            <filter src_ip="40.186.40.244" dst_ip="193.43.121.140" src_port="80"/>
        </slice>
        <from usec="0" sec="1255150802"/>
        <to usec="0" sec="1255151628"/>
    </anomaly>
    <anomaly type="anomalous" value="1.829470,1.472830,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="176.239.227.19" dst_ip="208.213.199.154" dst_port="80"/>
            <filter src_ip="176.239.227.19" dst_ip="164.67.26.210" dst_port="80"/>
        </slice>
        <from usec="0" sec="1255151547"/>
        <to usec="0" sec="1255151618"/>
    </anomaly>
    <anomaly type="anomalous" value="1.910250,1.471820,999,0 0 0 1 1 1 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="169.243.214.99" dst_ip="4.69.53.13"/>
            <filter src_ip="169.243.214.99" dst_ip="4.69.53.229" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.910250,1.471820,503,0 0 0 1 1 1 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="183.186.5.136" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.829470,1.472830,020,0 0 0 1 1 1 0 0 0 0 0 0,ptpDoSIC">
        <slice>
            <filter src_ip="219.206.71.35" dst_ip="193.43.134.25"/>
            <filter src_ip="216.40.142.86" dst_ip="193.43.134.25"/>
            <filter src_ip="216.217.149.105" dst_ip="193.43.134.25"/>
            <filter src_ip="43.178.195.59" dst_ip="193.43.134.25"/>
            <filter src_ip="34.199.233.45" dst_ip="193.43.134.25"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151538"/>
    </anomaly>
    <anomaly type="anomalous" value="2.681220,2.300280,999,1 1 0 0 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="192.8.123.42" src_port="3128"/>
            <filter src_ip="192.8.123.43" src_port="3128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.521150,1.432980,999,1 1 0 0 0 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="192.8.122.48"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.795050,1.666210,999,1 1 1 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.187.109.49" dst_port="53"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151700"/>
    </anomaly>
    <anomaly type="anomalous" value="3.393890,2.618620,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt139445">
        <slice>
            <filter src_ip="216.67.60.192" src_port="6000" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.577490,1.902450,999,1 1 1 1 1 1 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="192.8.122.49"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.217850,1.690390,999,1 0 0 1 1 0 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.8.122.48"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.795050,1.666210,020,1 1 1 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="23.183.46.223"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151341"/>
    </anomaly>
    <anomaly type="anomalous" value="1.403070,1.398210,502,0 0 0 0 0 0 1 1 1 1 0 0,alphfl">
        <slice>
            <filter src_ip="183.173.144.66" dst_ip="95.65.156.95" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.403070,1.398210,503,0 0 0 0 0 0 1 1 1 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="193.35.198.186" src_port="80"/>
            <filter dst_ip="193.35.198.186" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.137580,1.596590,503,1 0 0 1 1 1 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="192.8.125.56" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.418300,1.382480,999,1 0 0 0 0 0 1 1 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.8.117.1" dst_port="16881"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.529910,1.823910,999,1 1 0 1 1 1 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.8.122.49"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.324870,2.134950,012,0 0 0 0 0 0 0 0 0 1 1 1,malphfl">
        <slice>
            <filter src_ip="88.211.74.64" dst_ip="130.71.198.111" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.324870,2.134950,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="176.239.82.58" dst_ip="169.97.221.150" dst_port="80"/>
            <filter src_ip="176.239.82.58" dst_ip="209.81.170.37" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.272480,1.383370,503,1 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.8.123.34" dst_port="80"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151302"/>
    </anomaly>
    <anomaly type="suspicious" value="1.418370,1.434030,999,1 1 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="192.8.123.35"/>
            <filter dst_ip="130.71.167.3" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151611"/>
    </anomaly>
    <anomaly type="suspicious" value="1.335510,1.463360,020,1 1 1 0 0 0 0 0 0 0 0 0,ttl_error">
        <slice>
            <filter src_ip="183.44.12.55"/>
        </slice>
        <from usec="0" sec="1255150804"/>
        <to usec="0" sec="1255151191"/>
    </anomaly>
    <anomaly type="suspicious" value="1.380810,1.490770,999,0 1 1 0 0 0 1 0 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="200.56.209.223"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151251"/>
    </anomaly>
    <anomaly type="suspicious" value="0.805556,1.207600,503,1 1 0 0 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="176.239.25.77" dst_ip="151.192.120.98" dst_port="80"/>
        </slice>
        <from usec="0" sec="1255150804"/>
        <to usec="0" sec="1255151676"/>
    </anomaly>
    <anomaly type="suspicious" value="1.531350,1.532860,010,1 1 1 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="23.183.46.223" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151308"/>
    </anomaly>
    <anomaly type="suspicious" value="0.935558,1.191060,503,1 1 0 0 0 0 0 0 0 1 0 0,salphfl">
        <slice>
            <filter src_ip="176.239.204.2" dst_ip="31.141.110.173" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.888419,1.237500,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="183.173.5.153" src_port="53"/>
            <filter src_ip="183.173.5.153" dst_port="53"/>
        </slice>
        <from usec="0" sec="1255151205"/>
        <to usec="0" sec="1255151251"/>
    </anomaly>
    <anomaly type="suspicious" value="1.335510,1.463360,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="216.67.60.192" src_port="445" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1255151206"/>
        <to usec="0" sec="1255151211"/>
    </anomaly>
    <anomaly type="suspicious" value="1.335510,1.463360,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="148.21.204.139"/>
        </slice>
        <from usec="0" sec="1255151536"/>
        <to usec="0" sec="1255151540"/>
    </anomaly>
    <anomaly type="suspicious" value="0.805556,1.207600,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="148.22.12.39" dst_port="23"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255150846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065170,1.276660,010,1 1 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="148.21.4.145" dst_port="23"/>
        </slice>
        <from usec="0" sec="1255151205"/>
        <to usec="0" sec="1255151251"/>
    </anomaly>
    <anomaly type="suspicious" value="0.805556,1.207600,020,1 1 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="195.20.154.22"/>
        </slice>
        <from usec="0" sec="1255151250"/>
        <to usec="0" sec="1255151296"/>
    </anomaly>
    <anomaly type="suspicious" value="1.335510,1.463360,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="192.8.123.34" dst_ip="38.6.133.171" src_port="80"/>
        </slice>
        <from usec="0" sec="1255150804"/>
        <to usec="0" sec="1255151540"/>
    </anomaly>
    <anomaly type="suspicious" value="1.335510,1.463360,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="130.71.167.90" dst_ip="218.86.141.122" src_port="80"/>
        </slice>
        <from usec="0" sec="1255150943"/>
        <to usec="0" sec="1255151113"/>
    </anomaly>
    <anomaly type="suspicious" value="1.444200,1.462330,503,1 1 1 0 0 0 0 0 0 1 0 0,malphfl">
        <slice>
            <filter src_ip="176.239.140.114" dst_ip="199.4.184.10" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.335510,1.463360,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="40.186.52.233" dst_port="3389"/>
            <filter dst_ip="40.186.52.233"/>
        </slice>
        <from usec="0" sec="1255151289"/>
        <to usec="0" sec="1255151291"/>
    </anomaly>
    <anomaly type="suspicious" value="1.335510,1.463360,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="198.176.19.177" src_port="12200" dst_port="3128"/>
            <filter src_ip="198.176.19.177" src_port="12200" dst_port="1080"/>
            <filter src_ip="198.176.19.177" src_port="12200" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1255151627"/>
        <to usec="0" sec="1255151629"/>
    </anomaly>
    <anomaly type="suspicious" value="1.335510,1.463360,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.8.112.158" src_port="51440" dst_port="53"/>
        </slice>
        <from usec="0" sec="1255151020"/>
        <to usec="0" sec="1255151540"/>
    </anomaly>
    <anomaly type="suspicious" value="1.103390,1.254410,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="176.239.216.171"/>
        </slice>
        <from usec="0" sec="1255150850"/>
        <to usec="0" sec="1255150972"/>
    </anomaly>
    <anomaly type="suspicious" value="0.861409,1.219480,999,1 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="193.185.222.38" src_port="53"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151629"/>
    </anomaly>
    <anomaly type="suspicious" value="1.418370,1.434030,020,1 1 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="148.151.29.239"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255150846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.272480,1.383370,020,1 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="148.20.76.55"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255150846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.805556,1.207600,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="148.151.29.239" dst_port="23"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255150846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.861409,1.219480,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.187.109.49" src_port="53"/>
        </slice>
        <from usec="0" sec="1255151115"/>
        <to usec="0" sec="1255151620"/>
    </anomaly>
    <anomaly type="suspicious" value="1.290920,1.399280,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="89.88.211.132" src_port="80"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151251"/>
    </anomaly>
    <anomaly type="suspicious" value="0.778292,1.164840,999,0 0 0 0 0 0 1 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="176.239.45.246" src_port="53"/>
            <filter src_ip="176.239.45.246" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.861409,1.219480,010,1 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="21.225.141.181" dst_port="23"/>
        </slice>
        <from usec="0" sec="1255151205"/>
        <to usec="0" sec="1255151251"/>
    </anomaly>
    <anomaly type="suspicious" value="1.290920,1.399280,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="192.8.123.35" dst_port="3124"/>
            <filter dst_ip="192.8.123.35" dst_port="17660"/>
            <filter dst_ip="192.8.123.35" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255150846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.272480,1.383370,999,1 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="130.71.167.2" dst_port="3127"/>
            <filter dst_ip="130.71.167.2" dst_port="3128"/>
            <filter dst_ip="130.71.167.2" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151382"/>
    </anomaly>
    <anomaly type="suspicious" value="1.272480,1.383370,999,1 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="130.71.167.0" dst_port="56054"/>
            <filter dst_ip="130.71.167.0"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151296"/>
    </anomaly>
    <anomaly type="suspicious" value="1.021840,1.218250,999,1 0 0 0 0 0 1 1 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="183.173.149.46" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.888419,1.237500,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="132.216.141.80" src_port="80"/>
            <filter src_ip="73.128.70.103" dst_ip="132.216.141.80" src_port="43"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151296"/>
    </anomaly>
    <anomaly type="suspicious" value="1.290920,1.399280,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="132.216.141.68" src_port="53"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151296"/>
    </anomaly>
    <anomaly type="suspicious" value="1.290920,1.399280,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.8.125.57" dst_port="80"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151296"/>
    </anomaly>
    <anomaly type="suspicious" value="0.861409,1.219480,503,1 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="183.173.149.46" dst_port="80"/>
        </slice>
        <from usec="0" sec="1255150804"/>
        <to usec="0" sec="1255151700"/>
    </anomaly>
    <anomaly type="suspicious" value="0.778292,1.164840,503,0 0 0 0 0 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="193.35.226.115" src_port="53"/>
            <filter dst_ip="193.35.226.115" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.290920,1.399280,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.187.109.52" dst_port="53"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151296"/>
    </anomaly>
    <anomaly type="suspicious" value="1.290920,1.399280,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.8.113.63" dst_port="53"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151341"/>
    </anomaly>
    <anomaly type="suspicious" value="0.888419,1.237500,999,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="183.173.149.46" src_port="8080"/>
        </slice>
        <from usec="0" sec="1255151205"/>
        <to usec="0" sec="1255151251"/>
    </anomaly>
    <anomaly type="suspicious" value="0.888419,1.237500,999,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="183.173.5.156" src_port="25"/>
        </slice>
        <from usec="0" sec="1255151205"/>
        <to usec="0" sec="1255151251"/>
    </anomaly>
    <anomaly type="suspicious" value="0.888419,1.237500,999,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="183.173.224.170" src_port="3128"/>
        </slice>
        <from usec="0" sec="1255151205"/>
        <to usec="0" sec="1255151251"/>
    </anomaly>
    <anomaly type="suspicious" value="0.888419,1.237500,999,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="193.43.143.129" src_port="31983"/>
        </slice>
        <from usec="0" sec="1255151205"/>
        <to usec="0" sec="1255151251"/>
    </anomaly>
    <anomaly type="suspicious" value="0.888419,1.237500,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="89.66.84.67" src_port="1069" dst_port="1434"/>
            <filter src_ip="222.24.83.97" src_port="1069" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1255151205"/>
        <to usec="0" sec="1255151251"/>
    </anomaly>
    <anomaly type="suspicious" value="0.888419,1.237500,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="193.195.43.216" src_port="1096" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1255151205"/>
        <to usec="0" sec="1255151251"/>
    </anomaly>
    <anomaly type="suspicious" value="0.888419,1.237500,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="89.98.107.138" src_port="4582" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1255151205"/>
        <to usec="0" sec="1255151251"/>
    </anomaly>
    <anomaly type="suspicious" value="1.290920,1.399280,999,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="192.8.123.42" dst_port="3128"/>
            <filter dst_ip="192.8.123.43" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151296"/>
    </anomaly>
    <anomaly type="suspicious" value="1.290920,1.399280,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="130.71.167.9" dst_port="3124"/>
            <filter dst_ip="130.71.167.9" dst_port="3128"/>
            <filter dst_ip="130.71.167.9" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255150846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.272480,1.383370,503,1 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="176.239.150.8" dst_ip="220.73.71.4" dst_port="80"/>
        </slice>
        <from usec="0" sec="1255150800"/>
        <to usec="0" sec="1255151538"/>
    </anomaly>
    <anomaly type="suspicious" value="1.444200,1.462330,503,1 1 1 0 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="176.239.204.116" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.223680,1.321850,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="220.73.77.99" dst_ip="183.173.47.112" src_port="80"/>
            <filter src_ip="220.73.88.117" dst_ip="183.173.47.112" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.778292,1.164840,010,0 0 0 0 0 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="139.105.224.105" dst_port="135"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.223680,1.321850,010,0 0 0 0 0 0 0 0 0 1 1 0,sptpDoSSYN">
        <slice>
            <filter src_ip="130.71.68.165" dst_ip="43.201.89.134" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.223680,1.321850,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="183.186.5.187" dst_ip="4.69.53.213" src_port="80"/>
            <filter src_ip="183.186.5.187" dst_ip="4.69.53.186" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.223680,1.321850,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="136.184.249.24" dst_ip="130.71.68.116" src_port="80" dst_port="2140"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.223680,1.321850,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="204.245.83.223" dst_ip="176.239.53.200" src_port="80" dst_port="2806"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.223680,1.321850,010,0 0 0 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="66.250.141.7" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.223680,1.321850,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="8.122.216.120" dst_ip="130.71.70.177" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.223680,1.321850,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="176.239.53.200" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.223680,1.321850,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="183.173.149.46" dst_ip="216.113.53.129" src_port="8080" dst_port="55374"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.223680,1.321850,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="176.239.138.170" dst_ip="88.179.133.21" src_port="49161" dst_port="3133"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.223680,1.321850,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="130.71.167.81" dst_ip="29.101.59.173" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
