<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.461540,2.012380,999,1 1 0 1 1 1 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="214.168.166.248"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.853480,2.518720,020,1 1 0 0 0 0 1 1 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="1.180.157.224"/>
        </slice>
        <from usec="0" sec="1265086801"/>
        <to usec="0" sec="1265086847"/>
    </anomaly>
    <anomaly type="anomalous" value="2.082240,1.890200,999,1 1 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="149.88.46.64"/>
            <filter src_ip="149.88.67.29" dst_port="80"/>
            <filter dst_ip="214.161.145.141" dst_port="110"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.556690,1.470500,503,1 1 0 1 1 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="215.83.210.51" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.690950,1.547260,503,1 1 0 1 1 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="214.168.166.248" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="7.281450,6.337600,999,1 1 1 1 1 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="222.131.182.192" src_port="53"/>
            <filter dst_ip="222.131.182.192" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.690950,1.547260,503,1 1 0 1 1 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="215.83.208.28" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.660960,1.571320,503,1 1 0 1 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="215.83.220.168" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.868170,1.746110,020,1 1 1 1 0 0 1 0 0 1 0 0,ntscICecrqICecrqdurmterp">
        <slice>
            <filter dst_ip="35.0.163.175"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.151410,1.827630,503,1 1 1 1 1 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="214.160.136.26" dst_port="80"/>
            <filter src_ip="214.160.136.26" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.693270,2.286920,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="165.132.218.4" dst_ip="215.83.213.168"/>
            <filter src_ip="165.132.218.4" src_port="443"/>
            <filter dst_ip="215.83.213.168" src_port="443"/>
            <filter dst_ip="215.83.213.168" src_port="80"/>
            <filter dst_ip="215.83.213.168" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.336070,1.978620,503,1 1 0 1 1 1 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="215.83.210.51" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.702050,2.268690,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="149.88.52.144" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.009180,1.903970,503,0 0 0 1 1 1 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="145.212.237.97" src_port="80"/>
            <filter dst_ip="21.232.220.72" src_port="80"/>
            <filter src_ip="145.193.44.10" dst_ip="20.32.154.13" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.009180,1.903970,503,0 0 0 1 1 1 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="145.212.131.15" dst_ip="21.232.220.122" src_port="80"/>
            <filter src_ip="145.212.131.15" dst_ip="21.232.220.80" src_port="80"/>
            <filter src_ip="145.212.131.15" dst_ip="21.232.220.68" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.009180,1.903970,503,0 0 0 1 1 1 0 0 0 1 0 0,salphfl">
        <slice>
            <filter src_ip="215.83.212.122" dst_ip="21.232.220.20" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.693270,2.286920,999,0 0 0 1 1 1 0 0 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="149.88.204.44" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.168670,1.904220,503,1 0 0 1 1 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="214.160.136.26" src_port="80"/>
            <filter dst_ip="214.160.136.26" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.860450,1.590200,999,1 1 0 1 1 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="175.12.1.132" dst_port="3128"/>
            <filter dst_ip="175.12.1.132" dst_port="3124"/>
            <filter dst_ip="175.12.1.132" dst_port="3127"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.707360,2.947140,020,1 1 1 1 1 1 1 1 0 1 0 0,ntscICec">
        <slice>
            <filter src_ip="35.0.163.175"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.222090,1.925500,999,1 1 0 1 0 0 1 0 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="145.193.65.80" dst_port="53"/>
            <filter src_ip="149.88.240.103" src_port="53"/>
            <filter src_ip="149.88.240.103" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.785660,2.533870,010,0 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="20.40.203.72" dst_ip="215.83.217.241" dst_port="3127"/>
            <filter src_ip="20.40.203.72" dst_ip="215.83.217.241" dst_port="3128"/>
            <filter src_ip="20.40.203.72" dst_ip="215.83.217.241" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1265086801"/>
        <to usec="0" sec="1265086847"/>
    </anomaly>
    <anomaly type="anomalous" value="2.785660,2.533870,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="175.12.83.216" src_port="25576"/>
        </slice>
        <from usec="0" sec="1265086801"/>
        <to usec="0" sec="1265086847"/>
    </anomaly>
    <anomaly type="anomalous" value="1.573820,1.571800,503,0 0 0 1 1 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="215.83.208.28" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.588790,1.545170,503,1 0 0 1 1 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="214.168.46.251" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.693270,2.286920,503,0 0 0 1 1 1 0 0 0 1 1 1,point_to_point">
        <slice>
            <filter src_ip="161.160.226.155" dst_ip="145.32.6.222" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.993690,1.935500,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="175.12.237.151" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.702050,2.268690,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="175.12.1.202" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.374900,1.940940,503,1 1 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="215.83.217.254" src_port="53"/>
            <filter dst_ip="215.83.217.254" src_port="80"/>
            <filter dst_ip="215.83.213.195" src_port="53"/>
            <filter dst_ip="215.83.213.195" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.693270,2.286920,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="215.83.216.122" dst_ip="21.232.216.168"/>
            <filter src_ip="215.83.216.122" src_port="80"/>
            <filter src_ip="215.83.216.125" src_port="80"/>
            <filter dst_ip="21.232.216.168" src_port="80"/>
            <filter src_ip="215.83.211.86" dst_ip="21.232.216.123" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.993690,1.935500,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="149.88.137.235" dst_ip="199.175.52.141" src_port="80"/>
            <filter src_ip="149.88.137.235" dst_ip="35.96.86.200" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.897710,3.056840,999,1 1 0 1 1 1 1 1 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="175.12.1.132"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.993690,1.935500,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="215.170.244.86" dst_ip="215.83.213.58" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.134310,1.945280,503,0 0 0 1 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="145.208.185.97" src_port="80"/>
            <filter dst_ip="145.208.185.97" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.005540,1.913940,503,1 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="20.134.125.16" dst_ip="145.1.8.232" src_port="80"/>
            <filter src_ip="20.57.232.33" dst_ip="145.1.8.232" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.145380,1.923820,503,1 0 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="214.168.177.39" src_port="80"/>
            <filter dst_ip="214.168.177.39" src_port="53"/>
            <filter dst_ip="175.12.1.136" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.134310,1.945280,999,0 0 0 1 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="215.83.217.255" dst_port="17660"/>
            <filter dst_ip="215.83.217.255" dst_port="3127"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.993690,1.935500,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="145.193.2.87" dst_ip="21.232.216.11" src_port="80"/>
            <filter src_ip="175.12.164.59" dst_ip="21.232.216.11" src_port="80"/>
            <filter src_ip="136.112.120.10" dst_ip="21.232.216.11" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.534770,1.760490,504,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="145.193.132.42" dst_ip="161.81.119.119" dst_port="443"/>
            <filter src_ip="145.193.132.42" dst_ip="161.81.119.120" dst_port="443"/>
        </slice>
        <from usec="0" sec="1265086816"/>
        <to usec="0" sec="1265087360"/>
    </anomaly>
    <anomaly type="suspicious" value="1.367190,1.500240,503,1 1 0 1 1 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="149.88.219.65" dst_ip="193.153.152.156" dst_port="80"/>
        </slice>
        <from usec="0" sec="1265086801"/>
        <to usec="0" sec="1265087665"/>
    </anomaly>
    <anomaly type="suspicious" value="1.705760,1.735220,503,1 1 1 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="214.160.138.237" dst_ip="22.238.234.63" dst_port="80"/>
            <filter src_ip="214.160.138.237" dst_ip="196.41.66.238" dst_port="80"/>
            <filter src_ip="214.160.138.237" dst_ip="17.13.116.144" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.475920,1.559210,503,1 1 0 0 0 0 0 0 0 1 1 0,heavy_hitter">
        <slice>
            <filter src_ip="149.88.17.168" dst_ip="210.173.176.183" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.349560,1.423950,503,1 1 0 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="149.88.12.120" dst_port="80"/>
            <filter src_ip="149.88.12.127" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.534770,1.760490,999,1 1 1 0 0 0 0 0 0 0 0 0,ipv4gretun">
        <slice>
            <filter src_ip="215.106.235.48" dst_ip="214.160.136.70"/>
        </slice>
        <from usec="0" sec="1265086822"/>
        <to usec="0" sec="1265087684"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468610,1.527850,503,1 1 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="145.1.8.232" dst_ip="161.168.113.137" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.067870,1.436930,504,1 1 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="149.88.200.8" dst_ip="161.81.119.119" dst_port="443"/>
            <filter src_ip="149.88.200.8" dst_ip="161.160.40.32" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.713470,1.771230,010,1 1 1 1 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="215.83.196.74" dst_port="445"/>
        </slice>
        <from usec="0" sec="1265086801"/>
        <to usec="0" sec="1265087562"/>
    </anomaly>
    <anomaly type="suspicious" value="1.742560,1.749920,011,1 1 1 1 1 0 0 0 0 0 0 0,ntscTCPRSTrp">
        <slice>
            <filter dst_ip="35.2.137.110" dst_port="80"/>
        </slice>
        <from usec="0" sec="1265086801"/>
        <to usec="0" sec="1265087179"/>
    </anomaly>
    <anomaly type="suspicious" value="1.719740,1.798350,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="178.138.82.135" dst_port="23"/>
        </slice>
        <from usec="0" sec="1265087341"/>
        <to usec="0" sec="1265087387"/>
    </anomaly>
    <anomaly type="suspicious" value="1.534770,1.760490,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.222.158.9" dst_port="23"/>
        </slice>
        <from usec="0" sec="1265086934"/>
        <to usec="0" sec="1265086939"/>
    </anomaly>
    <anomaly type="suspicious" value="1.534770,1.760490,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="178.53.82.42" dst_port="23"/>
        </slice>
        <from usec="0" sec="1265087019"/>
        <to usec="0" sec="1265087024"/>
    </anomaly>
    <anomaly type="suspicious" value="1.719740,1.798350,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="177.96.135.71" dst_port="23"/>
        </slice>
        <from usec="0" sec="1265087341"/>
        <to usec="0" sec="1265087387"/>
    </anomaly>
    <anomaly type="suspicious" value="1.090060,1.512560,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="212.189.232.250" dst_port="23"/>
        </slice>
        <from usec="0" sec="1265087341"/>
        <to usec="0" sec="1265087387"/>
    </anomaly>
    <anomaly type="suspicious" value="1.719740,1.798350,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="178.136.40.104" dst_port="23"/>
        </slice>
        <from usec="0" sec="1265087251"/>
        <to usec="0" sec="1265087297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.534770,1.760490,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="6.33.236.118" dst_port="23"/>
        </slice>
        <from usec="0" sec="1265087660"/>
        <to usec="0" sec="1265087668"/>
    </anomaly>
    <anomaly type="suspicious" value="1.090060,1.512560,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="178.53.28.151" dst_port="23"/>
        </slice>
        <from usec="0" sec="1265086801"/>
        <to usec="0" sec="1265086847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.090060,1.512560,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="42.157.208.192" dst_port="445"/>
        </slice>
        <from usec="0" sec="1265086801"/>
        <to usec="0" sec="1265086847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.534770,1.760490,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="212.170.17.245" dst_port="23"/>
        </slice>
        <from usec="0" sec="1265087295"/>
        <to usec="0" sec="1265087300"/>
    </anomaly>
    <anomaly type="suspicious" value="1.534770,1.760490,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="33.24.149.0" dst_port="135"/>
        </slice>
        <from usec="0" sec="1265087425"/>
        <to usec="0" sec="1265087426"/>
    </anomaly>
    <anomaly type="suspicious" value="1.534770,1.760490,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="178.53.144.10" dst_port="23"/>
        </slice>
        <from usec="0" sec="1265087111"/>
        <to usec="0" sec="1265087117"/>
    </anomaly>
    <anomaly type="suspicious" value="1.534770,1.760490,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="178.138.82.135"/>
        </slice>
        <from usec="0" sec="1265087347"/>
        <to usec="0" sec="1265087350"/>
    </anomaly>
    <anomaly type="suspicious" value="1.090060,1.512560,020,1 1 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="213.22.168.210"/>
        </slice>
        <from usec="0" sec="1265087431"/>
        <to usec="0" sec="1265087477"/>
    </anomaly>
    <anomaly type="suspicious" value="1.534770,1.760490,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="178.53.144.10"/>
        </slice>
        <from usec="0" sec="1265087111"/>
        <to usec="0" sec="1265087117"/>
    </anomaly>
    <anomaly type="suspicious" value="1.090060,1.512560,020,1 1 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="1.222.158.9"/>
        </slice>
        <from usec="0" sec="1265086891"/>
        <to usec="0" sec="1265086939"/>
    </anomaly>
    <anomaly type="suspicious" value="1.404680,1.782100,504,0 0 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="149.88.17.168" dst_ip="29.130.191.81" src_port="47305" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1265087415"/>
        <to usec="0" sec="1265087426"/>
    </anomaly>
    <anomaly type="suspicious" value="1.519260,1.783910,020,0 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="178.136.40.104"/>
        </slice>
        <from usec="0" sec="1265087289"/>
        <to usec="0" sec="1265087293"/>
    </anomaly>
    <anomaly type="suspicious" value="1.719740,1.798350,503,1 1 1 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="215.83.217.240" dst_port="80"/>
        </slice>
        <from usec="0" sec="1265086801"/>
        <to usec="0" sec="1265087477"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177180,1.447830,999,1 0 0 1 0 0 1 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="215.83.216.119" src_port="63581"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.057750,1.402840,503,1 1 0 1 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="214.168.46.251" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.866210,1.927030,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="91.224.230.78" dst_ip="214.168.185.68" src_port="80"/>
            <filter src_ip="210.221.64.96" dst_ip="214.168.185.68" src_port="80"/>
        </slice>
        <from usec="0" sec="1265086805"/>
        <to usec="0" sec="1265086937"/>
    </anomaly>
    <anomaly type="suspicious" value="1.125720,1.454650,503,1 1 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="214.160.175.9" dst_port="80"/>
            <filter src_ip="214.160.175.9" dst_port="53"/>
        </slice>
        <from usec="0" sec="1265086801"/>
        <to usec="0" sec="1265087539"/>
    </anomaly>
    <anomaly type="suspicious" value="1.866210,1.927030,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="215.83.212.122" dst_ip="21.232.220.50" src_port="80"/>
            <filter src_ip="149.88.10.103" dst_ip="21.232.220.50" src_port="80"/>
        </slice>
        <from usec="0" sec="1265086808"/>
        <to usec="0" sec="1265087359"/>
    </anomaly>
    <anomaly type="suspicious" value="1.866210,1.927030,501,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="175.12.1.205" dst_ip="21.232.220.176" src_port="21"/>
        </slice>
        <from usec="0" sec="1265086802"/>
        <to usec="0" sec="1265087358"/>
    </anomaly>
    <anomaly type="suspicious" value="1.125720,1.454650,503,1 1 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="165.132.210.238" dst_port="80"/>
            <filter dst_ip="165.132.210.238" dst_port="443"/>
        </slice>
        <from usec="0" sec="1265086801"/>
        <to usec="0" sec="1265087666"/>
    </anomaly>
    <anomaly type="suspicious" value="1.219340,1.525530,999,0 0 0 1 1 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="149.88.213.156" src_port="33800"/>
        </slice>
        <from usec="0" sec="1265086801"/>
        <to usec="0" sec="1265087441"/>
    </anomaly>
    <anomaly type="suspicious" value="1.445070,1.468300,999,1 0 0 1 1 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="175.12.1.134"/>
            <filter dst_ip="175.12.1.134" dst_port="56054"/>
            <filter dst_ip="175.12.1.134"/>
            <filter dst_ip="215.83.213.221" dst_port="39684"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332070,1.552700,501,0 0 0 1 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="175.12.216.39" dst_ip="214.81.201.200" dst_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.219130,1.421680,503,1 0 0 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="215.83.220.168" src_port="80"/>
            <filter src_ip="215.83.220.169" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.340120,1.583560,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="149.88.2.113" dst_port="25"/>
            <filter src_ip="149.88.2.113" dst_ip="46.102.113.206" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.340120,1.583560,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="175.12.237.151" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.340120,1.583560,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="210.173.176.183" dst_ip="149.88.17.168" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.340120,1.583560,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="196.41.66.238" dst_ip="214.160.138.237" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.556840,1.569260,503,1 0 0 1 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="214.160.175.9" src_port="53"/>
            <filter dst_ip="214.160.175.9" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.340120,1.583560,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="149.88.24.29" dst_ip="36.42.60.45" src_port="80"/>
            <filter src_ip="149.88.24.25" dst_ip="36.42.60.45" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.340120,1.583560,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="20.44.213.156" dst_ip="214.168.42.175" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.340120,1.583560,999,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="222.57.181.230" dst_ip="215.83.217.196"/>
            <filter src_ip="222.57.181.230" src_port="53"/>
            <filter dst_ip="215.83.217.196" src_port="53"/>
            <filter src_ip="222.81.43.162" dst_ip="215.83.217.196" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
