<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.907260,1.363980,503,1 1 0 1 1 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="21.100.24.22" dst_ip="208.108.247.88" dst_port="80"/>
            <filter src_ip="20.37.125.50" dst_ip="208.108.247.88" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.647170,1.605400,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="163.234.35.1" dst_ip="197.4.133.48" dst_port="80"/>
            <filter src_ip="163.234.35.1" dst_ip="197.4.133.173" dst_port="80"/>
        </slice>
        <from usec="0" sec="1262322328"/>
        <to usec="0" sec="1262322381"/>
    </anomaly>
    <anomaly type="anomalous" value="1.705280,1.596890,999,1 1 1 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="136.25.199.215" src_port="25"/>
            <filter src_ip="136.25.199.215" dst_port="25"/>
        </slice>
        <from usec="0" sec="1262322099"/>
        <to usec="0" sec="1262322811"/>
    </anomaly>
    <anomaly type="anomalous" value="1.870380,1.592470,010,1 1 1 1 1 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="209.8.83.176" dst_port="135"/>
        </slice>
        <from usec="0" sec="1262322143"/>
        <to usec="0" sec="1262322687"/>
    </anomaly>
    <anomaly type="anomalous" value="1.647170,1.605400,999,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.234.103.18" src_port="7100" dst_port="3060"/>
            <filter dst_ip="163.234.103.18" src_port="8000" dst_port="8303"/>
        </slice>
        <from usec="0" sec="1262322669"/>
        <to usec="0" sec="1262322672"/>
    </anomaly>
    <anomaly type="anomalous" value="2.215170,1.603260,010,1 1 1 0 0 0 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="200.59.160.64" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.647170,1.605400,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="30.250.160.221" src_port="12200"/>
        </slice>
        <from usec="0" sec="1262322670"/>
        <to usec="0" sec="1262322673"/>
    </anomaly>
    <anomaly type="anomalous" value="1.647170,1.605400,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.62.67.1" src_port="2425" dst_port="2425"/>
        </slice>
        <from usec="0" sec="1262322836"/>
        <to usec="0" sec="1262322840"/>
    </anomaly>
    <anomaly type="anomalous" value="2.706800,1.824450,010,1 1 1 1 1 1 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="93.99.192.106" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.647170,1.605400,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="180.32.16.253" dst_port="23"/>
        </slice>
        <from usec="0" sec="1262322421"/>
        <to usec="0" sec="1262322432"/>
    </anomaly>
    <anomaly type="anomalous" value="1.647170,1.605400,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="43.87.136.69" dst_port="445"/>
        </slice>
        <from usec="0" sec="1262322486"/>
        <to usec="0" sec="1262322515"/>
    </anomaly>
    <anomaly type="anomalous" value="1.647170,1.605400,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="45.144.174.50" dst_port="25"/>
        </slice>
        <from usec="0" sec="1262322100"/>
        <to usec="0" sec="1262322113"/>
    </anomaly>
    <anomaly type="anomalous" value="2.281210,1.661670,503,1 1 1 1 1 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter dst_ip="208.108.249.83" dst_port="80"/>
            <filter dst_ip="208.108.249.82" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.055730,1.523290,503,1 0 0 1 1 1 0 0 0 1 1 1,malphfl">
        <slice>
            <filter src_ip="54.116.13.6" dst_ip="163.234.102.150" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.020180,1.543570,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="208.108.247.88" dst_ip="21.100.24.22" src_port="80"/>
            <filter src_ip="208.108.247.88" dst_ip="20.37.125.50" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.020180,1.543570,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="163.234.204.86" dst_ip="9.47.81.217" src_port="80"/>
            <filter src_ip="163.234.204.86" dst_ip="20.37.120.150" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.539630,1.678680,999,1 1 1 1 1 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="208.108.253.82"/>
            <filter src_ip="208.108.253.88" src_port="3128"/>
            <filter src_ip="208.108.253.88" src_port="17660"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.055730,1.523290,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="208.108.245.249" dst_ip="165.129.39.1"/>
            <filter src_ip="208.108.245.249" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.020180,1.543570,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="141.14.152.18" dst_ip="20.37.125.141" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.020180,1.543570,504,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="205.164.212.74" dst_ip="140.14.134.154" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.609390,1.802070,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="89.56.8.149" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.539630,1.678680,503,1 1 1 1 1 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.234.176.210"/>
            <filter dst_ip="163.234.176.222" dst_port="3128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.281210,1.661670,999,1 1 1 1 1 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="217.33.83.222" src_port="53"/>
            <filter dst_ip="217.33.83.222" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.843300,1.901980,999,1 1 1 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="208.108.253.88" dst_port="3128"/>
            <filter dst_ip="208.108.253.88" dst_port="3124"/>
            <filter dst_ip="208.108.253.82" dst_port="3128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.817700,1.254900,999,1 0 0 1 1 0 1 1 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="163.234.176.220" src_port="56054"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.587100,1.271270,053,1 0 0 0 0 0 1 1 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="208.108.242.166" dst_port="80"/>
            <filter src_ip="208.108.242.166" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.802140,1.324070,999,1 0 0 1 1 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter dst_ip="208.108.242.188"/>
            <filter src_ip="89.41.22.152" src_port="1480" dst_port="1434"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.074990,1.633580,502,0 0 0 1 1 1 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="199.221.50.161" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.560630,1.409490,020,0 0 0 1 1 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="21.89.160.128" dst_port="80"/>
            <filter dst_ip="21.89.160.128"/>
        </slice>
        <from usec="0" sec="1262322000"/>
        <to usec="0" sec="1262322901"/>
    </anomaly>
    <anomaly type="anomalous" value="1.297620,1.234330,503,0 0 0 1 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="136.6.228.136" dst_ip="20.37.120.228" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.343960,1.249890,503,1 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="136.25.212.127" dst_ip="20.150.187.237" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.020180,1.543570,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="136.25.199.77" dst_ip="33.42.2.48"/>
            <filter src_ip="136.25.199.77" src_port="80"/>
            <filter src_ip="136.25.189.46" dst_ip="33.42.2.48" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.015340,1.365170,503,1 0 0 1 1 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="163.234.176.222"/>
            <filter src_ip="163.234.176.223"/>
            <filter src_ip="163.234.176.210"/>
            <filter dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.343960,1.249890,503,1 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="163.234.117.174" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.596630,1.732860,503,1 1 0 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter src_ip="165.129.39.1" dst_ip="208.108.245.249"/>
            <filter dst_ip="208.108.245.249" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.257990,1.211180,999,0 0 0 1 0 0 1 1 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="209.72.24.104" src_port="31983"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.609780,1.233240,503,1 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="208.108.249.83" src_port="80"/>
            <filter src_ip="208.108.249.82" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.802140,1.324070,053,1 0 0 1 1 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter src_ip="208.108.253.89" dst_port="80"/>
            <filter src_ip="208.108.253.89" dst_port="53"/>
            <filter src_ip="208.108.242.188" dst_port="80"/>
            <filter src_ip="208.108.242.188" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.594160,1.230970,999,1 0 0 1 0 0 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="209.72.24.104" dst_port="31983"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.288930,1.274530,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.234.117.174" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.333220,1.187580,999,1 0 0 1 1 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.234.102.228" dst_port="15990"/>
            <filter dst_ip="163.234.102.228" src_port="8000" dst_port="8889"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.020180,1.543570,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="136.25.199.189" dst_ip="21.100.106.98" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.297620,1.234330,503,0 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="141.14.152.25" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.020180,1.543570,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="136.6.153.193" dst_ip="20.37.125.16"/>
            <filter src_ip="136.6.153.193" src_port="80"/>
            <filter dst_ip="20.37.125.16" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.338180,1.622570,011,1 1 0 1 1 1 1 0 0 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="93.99.192.106" src_port="2967" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.576390,1.301410,053,1 0 0 1 0 0 1 1 1 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="208.108.253.83" dst_port="53"/>
            <filter src_ip="208.108.253.83" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.529750,1.325090,999,0 0 0 1 0 0 1 1 1 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.234.197.101" dst_port="25576"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.384750,1.660870,503,1 1 1 1 0 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="208.108.253.89" src_port="80"/>
            <filter src_ip="21.113.202.184" dst_ip="208.108.253.89" dst_port="3124"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.297620,1.234330,503,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="140.14.133.104" src_port="80"/>
            <filter dst_ip="192.3.32.81" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.171040,1.400920,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.178.169.188" src_port="13452" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1262322034"/>
        <to usec="0" sec="1262322039"/>
    </anomaly>
    <anomaly type="suspicious" value="1.171040,1.400920,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="45.25.132.114"/>
        </slice>
        <from usec="0" sec="1262322256"/>
        <to usec="0" sec="1262322262"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007370,1.162260,999,1 0 0 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.234.102.228" src_port="15990"/>
            <filter src_ip="163.234.102.228" src_port="8889" dst_port="8000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.982524,1.282130,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="38.26.165.54" src_port="53"/>
        </slice>
        <from usec="0" sec="1262322000"/>
        <to usec="0" sec="1262322828"/>
    </anomaly>
    <anomaly type="suspicious" value="0.982524,1.282130,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="44.215.177.206" dst_ip="208.108.249.82" dst_port="80"/>
        </slice>
        <from usec="0" sec="1262322000"/>
        <to usec="0" sec="1262322183"/>
    </anomaly>
    <anomaly type="suspicious" value="0.982524,1.282130,020,0 0 0 1 1 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="208.108.244.183"/>
        </slice>
        <from usec="0" sec="1262322000"/>
        <to usec="0" sec="1262322556"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095780,1.235410,503,0 0 0 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="140.14.66.244" src_port="80"/>
            <filter dst_ip="0.104.138.132" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.128320,1.248710,999,1 0 0 0 0 0 1 1 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="163.234.197.101" src_port="25576"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.293400,1.388230,999,0 0 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="208.108.246.129" dst_port="7282"/>
        </slice>
        <from usec="0" sec="1262322000"/>
        <to usec="0" sec="1262322901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.284690,1.424080,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="136.25.199.209" dst_ip="200.9.240.20" dst_port="53"/>
            <filter src_ip="140.14.104.175" dst_ip="200.9.240.20" dst_port="53"/>
        </slice>
        <from usec="0" sec="1262322000"/>
        <to usec="0" sec="1262322046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.348250,1.365640,999,1 0 0 1 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="136.25.199.143" dst_port="53"/>
        </slice>
        <from usec="0" sec="1262322000"/>
        <to usec="0" sec="1262322901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.284690,1.424080,999,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="140.14.104.175" dst_ip="200.9.240.23" dst_port="53"/>
        </slice>
        <from usec="0" sec="1262322000"/>
        <to usec="0" sec="1262322046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.944902,1.318750,999,0 0 0 0 0 0 1 1 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="217.215.206.61"/>
        </slice>
        <from usec="0" sec="1262322045"/>
        <to usec="0" sec="1262322811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.944902,1.318750,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="136.25.140.224" src_port="9124"/>
        </slice>
        <from usec="0" sec="1262322765"/>
        <to usec="0" sec="1262322811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.944902,1.318750,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="170.241.146.154" src_port="80"/>
        </slice>
        <from usec="0" sec="1262322765"/>
        <to usec="0" sec="1262322811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.944902,1.318750,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="170.241.32.47" src_port="80"/>
        </slice>
        <from usec="0" sec="1262322765"/>
        <to usec="0" sec="1262322811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.944902,1.318750,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="136.25.199.209" src_port="53"/>
            <filter src_ip="136.25.199.209" dst_port="53"/>
        </slice>
        <from usec="0" sec="1262322765"/>
        <to usec="0" sec="1262322811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.944902,1.318750,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="21.89.160.128" src_port="80"/>
        </slice>
        <from usec="0" sec="1262322045"/>
        <to usec="0" sec="1262322856"/>
    </anomaly>
    <anomaly type="suspicious" value="1.284690,1.424080,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="217.169.108.183" dst_port="53"/>
        </slice>
        <from usec="0" sec="1262322855"/>
        <to usec="0" sec="1262322901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.284690,1.424080,020,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="208.108.253.83"/>
        </slice>
        <from usec="0" sec="1262322855"/>
        <to usec="0" sec="1262322901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.284690,1.424080,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="136.25.199.143" dst_ip="209.214.150.139" dst_port="53"/>
            <filter src_ip="136.25.199.143" dst_ip="20.187.83.180" dst_port="53"/>
        </slice>
        <from usec="0" sec="1262322855"/>
        <to usec="0" sec="1262322901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.284690,1.424080,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="217.33.83.216" dst_port="53"/>
        </slice>
        <from usec="0" sec="1262322855"/>
        <to usec="0" sec="1262322901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.284690,1.424080,999,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.234.130.87" dst_ip="203.1.152.248" dst_port="53"/>
        </slice>
        <from usec="0" sec="1262322855"/>
        <to usec="0" sec="1262322901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.284690,1.424080,999,0 0 0 0 0 0 1 1 1 0 0 0,malphfl">
        <slice>
            <filter src_ip="163.234.130.87" dst_ip="197.55.222.222" dst_port="53"/>
        </slice>
        <from usec="0" sec="1262322855"/>
        <to usec="0" sec="1262322901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.339890,1.402080,999,1 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="208.108.244.99" dst_port="53"/>
        </slice>
        <from usec="0" sec="1262322000"/>
        <to usec="0" sec="1262322901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.284690,1.424080,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="208.108.244.97" dst_port="53"/>
        </slice>
        <from usec="0" sec="1262322855"/>
        <to usec="0" sec="1262322901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.284690,1.424080,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="160.3.195.4" dst_port="36141"/>
        </slice>
        <from usec="0" sec="1262322855"/>
        <to usec="0" sec="1262322901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.284690,1.424080,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="217.224.248.209" dst_ip="136.25.199.143" src_port="53"/>
        </slice>
        <from usec="0" sec="1262322765"/>
        <to usec="0" sec="1262322901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.284690,1.424080,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="203.1.152.248" dst_ip="163.234.130.87" src_port="53"/>
        </slice>
        <from usec="0" sec="1262322855"/>
        <to usec="0" sec="1262322901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.284690,1.424080,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="208.108.243.80" src_port="53"/>
        </slice>
        <from usec="0" sec="1262322855"/>
        <to usec="0" sec="1262322901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.215770,1.398010,999,0 0 0 1 0 0 0 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="136.25.140.224" dst_port="9124"/>
        </slice>
        <from usec="0" sec="1262322000"/>
        <to usec="0" sec="1262322901"/>
    </anomaly>
    <anomaly type="suspicious" value="0.996151,1.204860,999,1 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="136.25.199.212" src_port="993"/>
            <filter src_ip="136.25.199.212" src_port="995"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007370,1.162260,503,1 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="209.72.156.112" dst_ip="209.66.32.225" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.932686,1.188720,503,0 0 0 1 0 0 0 0 0 1 1 0,heavy_hitter">
        <slice>
            <filter src_ip="208.108.254.201" dst_ip="90.40.253.136" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.996151,1.204860,503,1 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="197.37.137.131" dst_ip="209.67.105.133" src_port="80" dst_port="5284"/>
            <filter src_ip="197.37.137.131" dst_ip="209.67.105.133" src_port="80" dst_port="5283"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007370,1.162260,503,1 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.234.103.195" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.920559,1.230400,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="140.14.74.49" dst_ip="37.79.161.233" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.031840,1.177200,503,0 0 0 1 0 0 1 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="209.66.32.225" dst_ip="209.72.156.112" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.932686,1.188720,503,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="21.100.25.47" dst_ip="208.108.242.167"/>
            <filter src_ip="21.100.25.47" dst_port="80"/>
            <filter dst_ip="208.108.242.167" dst_port="80"/>
            <filter src_ip="200.16.74.188" dst_ip="208.108.242.167" dst_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.920559,1.230400,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="209.72.28.69" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.920559,1.230400,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="208.108.244.102" dst_ip="9.47.81.221" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.996151,1.204860,503,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="197.37.140.80" dst_ip="163.234.103.46"/>
            <filter src_ip="197.37.140.80" src_port="80"/>
            <filter dst_ip="163.234.103.46" src_port="80"/>
            <filter dst_ip="163.234.100.32" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.932686,1.188720,503,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="3.88.106.235" dst_port="80"/>
            <filter dst_ip="140.14.37.198" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.920559,1.230400,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="209.72.28.69" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.920559,1.230400,999,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="217.153.70.16" dst_ip="208.108.253.101"/>
            <filter src_ip="217.153.70.16" src_port="53"/>
            <filter src_ip="217.153.70.20" dst_ip="208.108.253.101"/>
            <filter src_ip="217.153.70.20" src_port="53"/>
            <filter dst_ip="208.108.253.101" src_port="53"/>
            <filter src_ip="217.196.104.17" dst_ip="208.108.253.101" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.920559,1.230400,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="156.225.201.50" dst_ip="20.37.126.171" src_port="13956" dst_port="36024"/>
            <filter src_ip="156.225.201.50" dst_ip="20.37.126.171" src_port="21" dst_port="41738"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.920559,1.230400,999,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="156.225.201.56" dst_ip="20.37.120.252"/>
            <filter src_ip="156.225.201.56" dst_ip="20.37.120.122" src_port="80"/>
            <filter src_ip="136.6.206.127" dst_ip="20.37.120.252" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
