<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.882020,1.784160,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="93.101.35.85" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.882020,1.784160,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="212.81.245.109" src_port="29358" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.299320,1.640940,503,1 1 1 1 1 0 1 1 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="201.92.9.40" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.783490,1.685330,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="201.92.5.34" src_port="80"/>
        </slice>
        <from usec="0" sec="1257915948"/>
        <to usec="0" sec="1257916130"/>
    </anomaly>
    <anomaly type="anomalous" value="2.810560,1.773450,503,1 1 1 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="157.75.114.147" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.741770,1.658990,011,1 1 1 0 0 0 1 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="218.90.1.18" src_port="135"/>
        </slice>
        <from usec="0" sec="1257915813"/>
        <to usec="0" sec="1257916321"/>
    </anomaly>
    <anomaly type="anomalous" value="1.783490,1.685330,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.81.182.47" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1257915987"/>
        <to usec="0" sec="1257915989"/>
    </anomaly>
    <anomaly type="anomalous" value="1.741770,1.658990,011,1 1 1 0 0 0 1 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="208.216.160.227" src_port="3050"/>
        </slice>
        <from usec="0" sec="1257916095"/>
        <to usec="0" sec="1257916186"/>
    </anomaly>
    <anomaly type="anomalous" value="2.241750,1.539750,999,0 0 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="164.231.83.86" dst_port="53"/>
            <filter src_ip="164.231.83.86" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.917920,1.493330,999,1 0 0 1 1 1 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.92.3.187"/>
        </slice>
        <from usec="0" sec="1257915600"/>
        <to usec="0" sec="1257916501"/>
    </anomaly>
    <anomaly type="anomalous" value="2.241750,1.539750,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="161.105.26.196" dst_ip="56.175.250.53" src_port="80"/>
            <filter src_ip="161.105.26.196" dst_ip="52.40.220.94" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.176940,1.695860,503,1 1 1 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="200.22.41.153" src_port="80"/>
            <filter dst_ip="155.183.132.37" src_port="80"/>
            <filter dst_ip="200.22.46.148" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.241750,1.539750,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="205.23.74.65" dst_ip="164.231.216.135" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.241750,1.539750,999,0 0 0 1 1 1 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="200.46.205.70" dst_ip="157.75.208.164" src_port="21"/>
            <filter src_ip="55.44.181.0" dst_ip="157.75.208.164" src_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.882020,1.784160,020,1 1 1 1 1 1 1 1 1 1 1 1,ntscICec">
        <slice>
            <filter src_ip="2.65.18.235"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.355920,1.584970,999,1 1 0 1 1 1 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="201.92.3.186"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.918200,1.415450,999,1 0 0 1 1 0 1 1 1 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="201.92.3.187"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.212500,1.482420,503,1 0 0 1 1 1 1 1 1 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="201.92.5.165" dst_ip="214.78.68.187" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.636170,1.736450,999,1 1 1 1 1 1 1 1 1 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.92.3.186"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.330720,1.552080,503,0 0 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="164.231.38.105"/>
            <filter dst_ip="110.184.76.174" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.656220,1.453670,503,0 0 0 1 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="52.33.34.149" dst_ip="161.174.0.66" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.241750,1.539750,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="5.70.62.37" src_port="80"/>
            <filter src_ip="56.181.215.162" dst_ip="161.116.17.53" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.960530,1.637570,999,1 1 1 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="55.44.181.0"/>
            <filter dst_ip="2.65.18.235"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.088490,1.441370,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="161.116.76.195"/>
        </slice>
        <from usec="0" sec="1257915600"/>
        <to usec="0" sec="1257916248"/>
    </anomaly>
    <anomaly type="suspicious" value="1.088490,1.441370,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="201.92.13.73"/>
        </slice>
        <from usec="0" sec="1257915600"/>
        <to usec="0" sec="1257916297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.319770,1.498930,503,1 1 0 0 0 0 1 1 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="164.231.7.80" dst_ip="220.54.175.184" dst_port="80"/>
        </slice>
        <from usec="0" sec="1257915600"/>
        <to usec="0" sec="1257916422"/>
    </anomaly>
    <anomaly type="suspicious" value="1.035420,1.444670,999,1 0 0 0 0 0 1 1 1 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="197.85.27.6"/>
        </slice>
        <from usec="0" sec="1257915600"/>
        <to usec="0" sec="1257916314"/>
    </anomaly>
    <anomaly type="suspicious" value="1.035420,1.444670,503,1 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="164.231.205.237" src_port="80"/>
            <filter src_ip="164.231.205.237" dst_port="80"/>
        </slice>
        <from usec="0" sec="1257915600"/>
        <to usec="0" sec="1257916321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.479400,1.541210,999,1 1 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="157.75.174.43" dst_port="3128"/>
            <filter dst_ip="157.75.174.43" dst_port="3124"/>
            <filter dst_ip="157.75.174.42" dst_port="3128"/>
            <filter dst_ip="157.75.174.42" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1257915600"/>
        <to usec="0" sec="1257916447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.956744,1.404220,999,0 0 0 0 0 0 1 1 1 1 0 0,ptmp">
        <slice>
            <filter src_ip="200.22.183.237" src_port="31983"/>
            <filter src_ip="200.22.183.237" src_port="28447"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.128550,1.398110,999,1 0 0 0 0 0 1 1 1 1 0 0,ptmp">
        <slice>
            <filter src_ip="201.92.2.118" src_port="3128"/>
            <filter src_ip="201.92.2.118" src_port="3127"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.152460,1.374870,503,1 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="56.181.215.9" dst_ip="161.116.79.52" src_port="80"/>
            <filter src_ip="205.179.99.253" dst_ip="161.116.79.52" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.365740,1.449710,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="217.128.84.42" dst_ip="164.231.172.200" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.984824,1.381070,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="4.209.218.40" dst_ip="161.174.82.247" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.365740,1.449710,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="161.116.84.197" src_port="80"/>
            <filter dst_ip="161.116.84.197" dst_port="57143"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.152460,1.374870,503,1 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.22.45.138" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907089,1.348800,503,0 0 0 0 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.92.5.35" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.365740,1.449710,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="164.231.133.64" src_port="80"/>
            <filter src_ip="164.231.133.64" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.984824,1.381070,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="157.75.114.84" dst_ip="48.20.44.48" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.984824,1.381070,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="201.92.10.139" dst_ip="57.52.227.180" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.984824,1.381070,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="219.185.229.153" dst_ip="161.174.87.174" src_port="80" dst_port="50972"/>
            <filter src_ip="219.185.229.153" dst_ip="161.174.87.174" src_port="80" dst_port="50971"/>
            <filter src_ip="219.185.229.153" dst_ip="161.174.87.174" src_port="80" dst_port="50970"/>
            <filter src_ip="219.185.229.153" dst_ip="161.174.87.174" src_port="80" dst_port="50968"/>
            <filter src_ip="219.185.229.153" dst_ip="161.174.87.174" src_port="80" dst_port="50967"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907089,1.348800,503,0 0 0 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="57.52.227.180" dst_ip="201.92.10.139"/>
            <filter src_ip="57.52.227.180" dst_port="80"/>
            <filter dst_ip="201.92.8.73" dst_port="53"/>
            <filter dst_ip="201.92.10.139" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.365740,1.449710,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="164.231.98.55" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.365740,1.449710,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="157.75.18.219" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.984824,1.381070,999,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="200.26.83.238" dst_port="110"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907089,1.348800,503,0 0 0 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="200.22.41.153" dst_port="80"/>
            <filter src_ip="200.22.44.134" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.365740,1.449710,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="164.231.202.34" dst_ip="61.132.20.94" dst_port="80"/>
            <filter src_ip="164.231.202.34" dst_ip="61.132.20.17" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.984824,1.381070,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="161.174.0.66" dst_ip="52.33.34.149" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
