<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.480870,1.441840,999,1 1 1 1 0 0 0 0 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="200.18.231.196"/>
        </slice>
        <from usec="0" sec="1260594001"/>
        <to usec="0" sec="1260594824"/>
    </anomaly>
    <anomaly type="anomalous" value="2.777550,2.055490,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="220.227.32.4" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.742480,1.380280,999,1 1 0 1 1 0 1 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="194.121.108.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.472810,1.455140,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="195.106.155.26" dst_ip="212.15.176.240" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594248"/>
        <to usec="0" sec="1260594660"/>
    </anomaly>
    <anomaly type="anomalous" value="1.472810,1.455140,502,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="17.213.205.47" dst_port="22"/>
        </slice>
        <from usec="0" sec="1260594791"/>
        <to usec="0" sec="1260594799"/>
    </anomaly>
    <anomaly type="anomalous" value="1.472810,1.455140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="4.115.230.54" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594701"/>
        <to usec="0" sec="1260594711"/>
    </anomaly>
    <anomaly type="anomalous" value="1.472810,1.455140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="9.162.98.117" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594814"/>
        <to usec="0" sec="1260594822"/>
    </anomaly>
    <anomaly type="anomalous" value="2.722360,2.026680,503,1 1 1 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="195.106.157.223" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.472810,1.455140,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="168.140.151.91" dst_ip="206.104.201.30" dst_port="80"/>
            <filter src_ip="168.140.151.91" dst_ip="140.157.93.208" dst_port="443"/>
        </slice>
        <from usec="0" sec="1260594190"/>
        <to usec="0" sec="1260594204"/>
    </anomaly>
    <anomaly type="anomalous" value="1.472810,1.455140,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="130.108.41.145" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594240"/>
        <to usec="0" sec="1260594836"/>
    </anomaly>
    <anomaly type="anomalous" value="1.472810,1.455140,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="172.216.216.142" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594243"/>
        <to usec="0" sec="1260594854"/>
    </anomaly>
    <anomaly type="anomalous" value="1.480870,1.441840,503,1 1 1 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="70.62.243.213" dst_ip="130.108.162.27" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594043"/>
        <to usec="0" sec="1260594837"/>
    </anomaly>
    <anomaly type="anomalous" value="1.893410,1.634800,503,1 1 0 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="172.216.96.219" dst_port="80"/>
            <filter src_ip="172.216.96.219" dst_port="443"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594832"/>
    </anomaly>
    <anomaly type="anomalous" value="2.449580,1.896040,999,1 1 1 1 1 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter dst_ip="130.108.162.123"/>
            <filter dst_ip="195.106.61.189" dst_port="31983"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.641210,1.354070,503,1 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="194.121.96.13" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.777550,2.055490,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="86.224.42.85" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.777550,2.055490,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="213.135.23.99" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.329450,1.792760,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="194.121.104.172" dst_ip="200.104.73.238"/>
            <filter src_ip="194.121.104.172" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.722360,2.026680,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt139445">
        <slice>
            <filter src_ip="220.162.200.70" src_port="6000" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.090760,1.769870,503,1 1 1 1 0 0 1 1 1 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="130.108.162.122" dst_port="53"/>
            <filter dst_ip="130.108.162.122"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.995520,1.776770,999,1 1 1 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.220.197.240" dst_port="53"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594856"/>
    </anomaly>
    <anomaly type="anomalous" value="2.136460,1.657060,010,1 1 1 1 0 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="86.255.119.171" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.780140,1.590010,503,1 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="40.1.51.136" dst_ip="172.216.76.171" src_port="80"/>
            <filter src_ip="194.6.43.234" dst_ip="172.216.76.171" src_port="80"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594828"/>
    </anomaly>
    <anomaly type="anomalous" value="1.879960,1.594410,011,1 0 0 1 1 1 0 0 0 1 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="213.135.23.99" src_port="2967" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.329450,1.792760,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="168.146.237.231" src_port="80"/>
            <filter src_ip="168.146.237.206" dst_ip="37.203.37.200" src_port="80"/>
            <filter src_ip="168.146.237.206" dst_ip="220.5.116.37" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.329450,1.792760,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="195.106.157.223" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.589760,1.545640,010,1 1 0 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="179.91.124.168" dst_port="6887"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="anomalous" value="2.040330,1.643570,020,0 0 0 1 1 1 0 0 0 1 1 0,icmp_error">
        <slice>
            <filter dst_ip="21.203.21.168"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.641210,1.354070,503,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="1.130.107.147"/>
            <filter src_ip="130.108.162.122" dst_ip="24.23.228.189" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.136460,1.657060,503,1 1 1 1 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="194.121.108.59" dst_ip="85.64.64.166" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.329450,1.792760,503,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="85.64.64.166" dst_ip="194.121.108.59" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.329450,1.792760,999,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="194.121.108.53" dst_ip="40.187.203.105" dst_port="17023"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.598670,1.375110,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="168.146.151.24" dst_ip="20.173.168.35" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.073560,1.554930,999,1 1 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="194.121.103.121"/>
            <filter src_ip="130.108.162.123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.641210,1.354070,503,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="197.44.121.12" src_port="80"/>
            <filter dst_ip="130.108.41.145" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.598670,1.375110,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="86.157.226.172" dst_ip="168.149.174.142" src_port="80" dst_port="58676"/>
            <filter src_ip="86.157.226.172" dst_ip="168.149.174.142" src_port="80" dst_port="56567"/>
            <filter src_ip="86.157.226.172" dst_ip="168.149.174.142" src_port="80" dst_port="56379"/>
            <filter src_ip="86.157.226.172" dst_ip="168.149.174.142" src_port="80" dst_port="56298"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.606100,1.361030,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="195.106.152.169" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.598670,1.375110,020,0 0 0 0 0 0 0 0 0 1 1 1,ntscUDPICdurp">
        <slice>
            <filter dst_ip="103.149.11.95"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.794240,1.548840,999,1 0 0 0 0 0 1 1 1 1 1 0,mptp">
        <slice>
            <filter dst_ip="130.108.162.120" dst_port="56054"/>
            <filter dst_ip="130.108.162.120"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.130880,1.668650,010,1 1 1 0 0 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="80.142.234.0" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.032140,1.637870,503,1 0 0 1 1 0 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="194.121.104.172" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.068080,1.637820,011,1 0 0 1 1 1 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="220.162.200.70" src_port="445" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.606100,1.361030,504,0 0 0 1 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="213.226.142.169" dst_ip="172.216.130.164" src_port="80"/>
            <filter src_ip="37.227.169.101" dst_ip="172.216.130.164" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.598670,1.375110,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="179.38.140.66" dst_ip="212.253.199.203" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.212310,1.344850,503,1 1 0 0 0 0 0 0 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="130.108.162.119" src_port="80"/>
        </slice>
        <from usec="0" sec="1260594455"/>
        <to usec="0" sec="1260594835"/>
    </anomaly>
    <anomaly type="suspicious" value="1.453010,1.498190,503,1 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="20.173.174.205" dst_ip="194.121.109.100" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594851"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,503,1 1 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="195.106.155.211" dst_ip="215.200.203.3"/>
            <filter src_ip="195.106.155.211" dst_ip="197.70.24.109" dst_port="443"/>
            <filter src_ip="195.106.155.211" dst_ip="213.226.142.169" dst_port="80"/>
            <filter src_ip="195.106.43.161" dst_ip="215.200.203.3" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594602"/>
        <to usec="0" sec="1260594707"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="168.140.81.91" dst_ip="22.66.12.106" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594651"/>
        <to usec="0" sec="1260594654"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="194.121.108.70" dst_ip="220.66.41.234" src_port="80"/>
        </slice>
        <from usec="0" sec="1260594041"/>
        <to usec="0" sec="1260594466"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="173.80.49.6" src_port="3810"/>
        </slice>
        <from usec="0" sec="1260594542"/>
        <to usec="0" sec="1260594817"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="130.108.40.53" dst_ip="215.200.202.46" src_port="4080" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594041"/>
        <to usec="0" sec="1260594798"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="168.140.179.117" dst_ip="21.168.0.14" src_port="8080"/>
        </slice>
        <from usec="0" sec="1260594189"/>
        <to usec="0" sec="1260594483"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="172.216.89.153" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594481"/>
        <to usec="0" sec="1260594659"/>
    </anomaly>
    <anomaly type="suspicious" value="1.050510,1.151090,503,1 1 0 1 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="195.96.1.143" dst_port="53"/>
            <filter src_ip="195.96.1.143" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="215.200.203.44" dst_ip="130.108.41.238" src_port="80" dst_port="53731"/>
        </slice>
        <from usec="0" sec="1260594237"/>
        <to usec="0" sec="1260594246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="195.106.36.217" dst_ip="17.65.15.129" src_port="49489" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594386"/>
        <to usec="0" sec="1260594589"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,503,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="43.194.21.83" dst_ip="194.121.103.120" src_port="49681" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594850"/>
        <to usec="0" sec="1260594852"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,503,1 1 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="20.26.133.1" dst_ip="172.216.216.142" src_port="80" dst_port="1126"/>
            <filter src_ip="20.26.133.95" dst_ip="172.216.216.142" src_port="80" dst_port="1095"/>
            <filter src_ip="137.160.47.60" dst_ip="172.216.216.142" src_port="80" dst_port="1788"/>
        </slice>
        <from usec="0" sec="1260594157"/>
        <to usec="0" sec="1260594835"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,502,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="25.127.89.73" dst_port="22"/>
        </slice>
        <from usec="0" sec="1260594219"/>
        <to usec="0" sec="1260594228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,504,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="168.140.136.11" dst_ip="140.157.93.208" src_port="63138" dst_port="443"/>
            <filter src_ip="168.140.136.11" dst_ip="140.157.93.208" src_port="62760" dst_port="443"/>
            <filter src_ip="168.140.136.11" dst_ip="140.157.93.208" src_port="61654" dst_port="443"/>
            <filter src_ip="168.140.136.11" dst_ip="140.157.93.208" src_port="61060" dst_port="443"/>
        </slice>
        <from usec="0" sec="1260594495"/>
        <to usec="0" sec="1260594499"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,502,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="2.93.48.11" dst_port="22"/>
        </slice>
        <from usec="0" sec="1260594501"/>
        <to usec="0" sec="1260594507"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="87.75.68.227" src_port="43886" dst_port="137"/>
        </slice>
        <from usec="0" sec="1260594673"/>
        <to usec="0" sec="1260594686"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="144.0.193.72" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594248"/>
        <to usec="0" sec="1260594258"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="145.171.245.231" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594603"/>
        <to usec="0" sec="1260594611"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="150.133.57.162" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594833"/>
        <to usec="0" sec="1260594844"/>
    </anomaly>
    <anomaly type="suspicious" value="1.008910,1.211250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="212.168.182.164" dst_port="445"/>
        </slice>
        <from usec="0" sec="1260594443"/>
        <to usec="0" sec="1260594499"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="150.86.27.126" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594785"/>
        <to usec="0" sec="1260594796"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="150.87.183.37" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594237"/>
        <to usec="0" sec="1260594246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="150.84.83.184" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594025"/>
        <to usec="0" sec="1260594034"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="150.213.80.186" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594187"/>
        <to usec="0" sec="1260594196"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="150.135.203.113" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594828"/>
        <to usec="0" sec="1260594837"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="26.204.246.98" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594199"/>
        <to usec="0" sec="1260594209"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="2.63.74.157" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594536"/>
        <to usec="0" sec="1260594545"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.202.214.1" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594648"/>
        <to usec="0" sec="1260594659"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="26.69.21.210" dst_port="445"/>
            <filter src_ip="26.69.21.210" dst_port="139"/>
        </slice>
        <from usec="0" sec="1260594190"/>
        <to usec="0" sec="1260594534"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="150.132.171.10" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594465"/>
        <to usec="0" sec="1260594475"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="150.133.181.44" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594654"/>
        <to usec="0" sec="1260594660"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="192.150.208.89" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594684"/>
        <to usec="0" sec="1260594689"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="150.86.119.218" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594843"/>
        <to usec="0" sec="1260594854"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="29.245.204.186" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594379"/>
        <to usec="0" sec="1260594390"/>
    </anomaly>
    <anomaly type="suspicious" value="0.845211,1.161680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="145.171.245.231"/>
        </slice>
        <from usec="0" sec="1260594604"/>
        <to usec="0" sec="1260594610"/>
    </anomaly>
    <anomaly type="suspicious" value="1.050510,1.151090,503,1 1 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="195.106.152.169" dst_port="80"/>
            <filter dst_ip="215.238.172.201" dst_port="80"/>
            <filter dst_ip="22.59.70.90" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046200,1.227880,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="32.124.163.12" dst_ip="130.108.49.67" src_port="80"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594699"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046200,1.227880,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="173.80.59.158" dst_ip="20.173.168.57" src_port="80"/>
        </slice>
        <from usec="0" sec="1260594003"/>
        <to usec="0" sec="1260594068"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046200,1.227880,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="168.140.150.103" dst_ip="13.21.28.147" src_port="80" dst_port="1506"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594006"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046200,1.227880,503,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="172.216.84.25" dst_ip="20.184.89.102" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594005"/>
        <to usec="0" sec="1260594106"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046200,1.227880,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="172.216.149.184" dst_ip="212.170.117.80" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594048"/>
        <to usec="0" sec="1260594146"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046200,1.227880,504,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="173.80.6.32" dst_ip="20.173.168.192" src_port="443"/>
        </slice>
        <from usec="0" sec="1260594003"/>
        <to usec="0" sec="1260594738"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046200,1.227880,010,0 0 0 1 1 0 0 0 0 0 0 0,sptpDoSSYN">
        <slice>
            <filter src_ip="172.216.64.216" dst_ip="214.235.106.200" dst_port="25"/>
        </slice>
        <from usec="0" sec="1260594005"/>
        <to usec="0" sec="1260594816"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046200,1.227880,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="194.121.115.158" dst_ip="32.191.100.214" src_port="1060" dst_port="14859"/>
        </slice>
        <from usec="0" sec="1260594442"/>
        <to usec="0" sec="1260594467"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046200,1.227880,502,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="195.201.138.7" dst_ip="148.218.10.37" src_port="22"/>
            <filter src_ip="195.201.138.156" dst_ip="148.218.10.37" src_port="22"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594648"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046200,1.227880,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="200.147.44.253" dst_ip="10.208.145.100" src_port="53"/>
            <filter src_ip="200.147.44.203" dst_ip="10.208.145.100" src_port="53"/>
            <filter src_ip="200.147.44.205" dst_ip="10.208.145.100" src_port="53"/>
        </slice>
        <from usec="0" sec="1260594012"/>
        <to usec="0" sec="1260594644"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046200,1.227880,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="168.140.81.40" dst_ip="123.29.48.163" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594634"/>
        <to usec="0" sec="1260594664"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046200,1.227880,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="168.146.73.153" dst_ip="20.173.174.94" src_port="80"/>
            <filter src_ip="168.146.73.153" dst_ip="214.25.161.236" src_port="80"/>
        </slice>
        <from usec="0" sec="1260594001"/>
        <to usec="0" sec="1260594737"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046200,1.227880,999,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="130.108.53.18" dst_ip="200.72.48.132" dst_port="53"/>
        </slice>
        <from usec="0" sec="1260594006"/>
        <to usec="0" sec="1260594806"/>
    </anomaly>
    <anomaly type="suspicious" value="0.790958,1.133200,020,1 0 0 1 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="179.91.124.168"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594466"/>
    </anomaly>
    <anomaly type="suspicious" value="1.461180,1.485280,010,1 0 0 1 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="194.121.103.120" dst_port="3128"/>
            <filter dst_ip="194.121.103.113" dst_port="3124"/>
            <filter dst_ip="194.121.103.113" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594766"/>
    </anomaly>
    <anomaly type="suspicious" value="1.453010,1.498190,999,1 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.220.197.244" dst_port="53"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="0.775755,1.150080,503,1 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="195.96.1.143" src_port="53"/>
            <filter dst_ip="195.96.1.143" src_port="80"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594839"/>
    </anomaly>
    <anomaly type="suspicious" value="1.421620,1.491620,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.220.197.240" src_port="53"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594856"/>
    </anomaly>
    <anomaly type="suspicious" value="1.421620,1.491620,999,0 0 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="194.121.103.121" dst_port="17660"/>
            <filter dst_ip="194.121.103.121" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594828"/>
    </anomaly>
    <anomaly type="suspicious" value="0.775755,1.150080,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="150.87.151.70" dst_port="23"/>
        </slice>
        <from usec="0" sec="1260594450"/>
        <to usec="0" sec="1260594496"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="194.121.104.14" dst_ip="205.163.36.114" dst_port="53"/>
            <filter src_ip="195.106.61.21" dst_ip="205.163.36.114" dst_port="53"/>
            <filter src_ip="195.106.153.10" dst_ip="205.163.36.114" dst_port="53"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.92.246.171" dst_port="53"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,010,0 0 0 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="194.121.103.112" dst_port="3128"/>
            <filter dst_ip="194.121.103.112" dst_port="3124"/>
            <filter dst_ip="194.121.103.112" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="194.121.105.88" dst_port="53"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="194.121.105.91" dst_port="53"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="22.145.221.123" dst_port="53"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.421620,1.491620,999,0 0 0 1 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="195.205.25.44" dst_ip="151.79.61.177" src_port="53"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="194.121.96.12" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.421620,1.491620,503,0 0 0 1 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="194.121.96.13" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="0.775755,1.150080,020,1 0 0 0 0 0 1 0 0 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="41.5.22.217"/>
        </slice>
        <from usec="0" sec="1260594720"/>
        <to usec="0" sec="1260594766"/>
    </anomaly>
    <anomaly type="suspicious" value="0.968696,1.298740,999,0 0 0 0 0 0 0 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="194.121.104.14" dst_ip="205.163.36.124" dst_port="53"/>
            <filter src_ip="195.106.61.21" dst_ip="205.163.36.124" dst_port="53"/>
            <filter src_ip="195.106.153.10" dst_ip="205.163.36.124" dst_port="53"/>
        </slice>
        <from usec="0" sec="1260594495"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="168.140.150.78" dst_ip="19.216.73.73" dst_port="53"/>
            <filter src_ip="168.140.150.20" dst_ip="19.216.73.73" dst_port="53"/>
            <filter src_ip="168.140.150.76" dst_ip="19.216.73.73" dst_port="53"/>
        </slice>
        <from usec="0" sec="1260594495"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.421620,1.491620,999,0 0 0 1 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="168.140.150.78" dst_ip="19.216.76.219" dst_port="53"/>
            <filter src_ip="168.140.150.20" dst_ip="19.216.76.219" dst_port="53"/>
            <filter src_ip="168.140.150.76" dst_ip="19.216.76.219" dst_port="53"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594558"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="194.121.108.83"/>
        </slice>
        <from usec="0" sec="1260594495"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="172.216.234.118" dst_port="37437"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="59.248.49.109"/>
            <filter dst_ip="59.248.49.109" src_port="3072" dst_port="80"/>
            <filter dst_ip="59.248.49.109" src_port="1024" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594495"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,011,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="194.121.103.120" dst_ip="145.138.66.42" src_port="3128"/>
        </slice>
        <from usec="0" sec="1260594495"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="172.216.244.235" dst_ip="215.59.207.146" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594495"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="172.216.137.172" dst_port="33800"/>
        </slice>
        <from usec="0" sec="1260594000"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="168.140.150.78" dst_ip="22.39.169.192" dst_port="53"/>
            <filter src_ip="168.140.150.20" dst_ip="22.39.169.192" dst_port="53"/>
            <filter src_ip="168.140.150.76" dst_ip="22.39.169.192" dst_port="53"/>
        </slice>
        <from usec="0" sec="1260594495"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="195.106.156.81" dst_ip="195.97.158.219" dst_port="80"/>
        </slice>
        <from usec="0" sec="1260594495"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="195.205.25.44" dst_ip="10.64.169.8" src_port="53"/>
        </slice>
        <from usec="0" sec="1260594495"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="195.205.25.44" dst_ip="10.64.169.9" src_port="53"/>
        </slice>
        <from usec="0" sec="1260594495"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.114400,1.343260,011,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="130.108.162.119" src_port="53"/>
        </slice>
        <from usec="0" sec="1260594495"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.114930,1.341900,999,0 0 0 0 0 0 1 0 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="194.121.104.14" dst_ip="205.163.36.124" dst_port="53"/>
            <filter src_ip="195.106.61.21" dst_ip="205.163.36.124" dst_port="53"/>
            <filter src_ip="195.106.153.10" dst_ip="205.163.36.124" dst_port="53"/>
        </slice>
        <from usec="0" sec="1260594495"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="130.108.40.33" src_port="8000" dst_port="8000"/>
        </slice>
        <from usec="0" sec="1260594495"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.413220,1.504480,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="168.140.206.125" dst_port="9124"/>
        </slice>
        <from usec="0" sec="1260594495"/>
        <to usec="0" sec="1260594541"/>
    </anomaly>
    <anomaly type="suspicious" value="0.757255,1.095200,503,0 0 0 1 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="130.108.162.27" dst_ip="85.67.232.33" src_port="80"/>
            <filter src_ip="130.108.162.27" dst_ip="70.62.243.213" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.757255,1.095200,501,0 0 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="194.121.108.71" dst_ip="219.213.215.198"/>
            <filter src_ip="194.121.108.71" src_port="21"/>
            <filter dst_ip="219.213.215.198" src_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814646,1.104130,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="199.90.43.94" dst_ip="130.108.104.158" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.757255,1.095200,503,0 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="215.200.202.81" src_port="80"/>
            <filter dst_ip="195.106.43.161" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814646,1.104130,999,1 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="194.121.108.83" dst_port="80"/>
            <filter dst_ip="194.121.108.83"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814646,1.104130,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="172.216.176.214" dst_ip="199.90.42.132" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814646,1.104130,503,1 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="130.108.41.177" dst_ip="215.200.202.12" src_port="50453" dst_port="80"/>
            <filter src_ip="130.108.41.177" dst_ip="215.200.202.12" src_port="50401" dst_port="80"/>
            <filter src_ip="130.108.41.177" dst_ip="215.200.202.12"/>
            <filter src_ip="130.108.41.31" dst_ip="215.200.202.12" src_port="4198" dst_port="80"/>
            <filter src_ip="130.108.237.147" dst_ip="215.200.202.12" src_port="61247" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814646,1.104130,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="172.216.76.171" dst_ip="8.78.158.229" src_port="58144" dst_port="80"/>
            <filter src_ip="172.216.76.171" dst_ip="8.78.158.229" src_port="56620" dst_port="80"/>
            <filter src_ip="172.216.76.171" dst_ip="8.78.158.229" src_port="56431" dst_port="80"/>
            <filter src_ip="172.216.76.171" dst_ip="8.78.158.229" src_port="56343" dst_port="80"/>
            <filter src_ip="172.216.76.171" dst_ip="8.78.158.229" src_port="54398" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.136800,1.174000,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="168.146.73.122" dst_ip="214.25.161.117" src_port="80"/>
            <filter src_ip="168.146.73.122" dst_ip="20.173.168.55" src_port="80"/>
            <filter src_ip="168.146.73.122" dst_ip="20.184.144.122" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.975080,1.151400,503,0 0 0 1 0 0 0 0 0 0 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="130.108.162.27" dst_ip="85.67.232.33" src_port="80"/>
            <filter src_ip="130.108.162.27" dst_ip="70.62.243.213" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.147230,1.157470,503,0 0 0 1 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="75.30.70.61" dst_ip="172.216.234.103" src_port="80"/>
            <filter src_ip="137.160.46.52" dst_ip="172.216.234.103" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.829137,1.086540,503,1 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="172.216.96.131" dst_port="80"/>
            <filter dst_ip="195.97.163.44" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.136800,1.174000,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="215.200.202.8" dst_ip="195.96.1.143" src_port="80" dst_port="16686"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.136800,1.174000,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="21.168.16.144" dst_ip="130.108.41.208" src_port="82" dst_port="3900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.136800,1.174000,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="220.108.244.14" dst_ip="172.216.116.21" src_port="80"/>
            <filter src_ip="32.236.110.85" dst_ip="172.216.116.21" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.136800,1.174000,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="24.0.11.255" dst_ip="130.108.41.202" src_port="80"/>
            <filter src_ip="215.200.202.238" dst_ip="130.108.41.202" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.147230,1.157470,503,0 0 0 1 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="194.121.104.172" dst_ip="200.104.73.213" src_port="80" dst_port="61203"/>
            <filter src_ip="194.121.104.172" dst_ip="200.104.73.213" src_port="80" dst_port="59319"/>
            <filter src_ip="194.121.104.172" dst_ip="200.104.73.213" src_port="80" dst_port="59300"/>
            <filter src_ip="194.121.104.172" dst_ip="200.104.73.213" src_port="80" dst_port="58493"/>
            <filter src_ip="168.140.145.17" dst_ip="200.104.73.213" src_port="443" dst_port="51985"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.136800,1.174000,020,0 0 0 0 0 0 0 0 0 1 1 0,icmp_error">
        <slice>
            <filter dst_ip="21.203.21.143" dst_port="80"/>
            <filter dst_ip="21.203.21.143"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
