<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.179170,1.789720,502,1 1 1 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="205.20.85.57" dst_port="22"/>
        </slice>
        <from usec="0" sec="1270357336"/>
        <to usec="0" sec="1270357877"/>
    </anomaly>
    <anomaly type="anomalous" value="2.082640,1.791220,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="29.140.99.174" src_port="4899"/>
        </slice>
        <from usec="0" sec="1270357738"/>
        <to usec="0" sec="1270358043"/>
    </anomaly>
    <anomaly type="anomalous" value="2.561430,1.781570,010,1 1 1 1 1 1 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.90.116.109" src_port="6000" dst_port="80"/>
        </slice>
        <from usec="0" sec="1270357831"/>
        <to usec="0" sec="1270357877"/>
    </anomaly>
    <anomaly type="anomalous" value="2.112380,1.763720,011,1 1 1 0 0 0 0 0 0 1 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="182.4.114.35" src_port="4899"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.944800,1.467980,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="204.94.13.118" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.944800,1.467980,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="215.62.162.75" dst_ip="137.232.113.150" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.657400,1.400280,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="4.121.210.82" dst_ip="204.83.54.56" src_port="80" dst_port="13711"/>
        </slice>
        <from usec="0" sec="1270357201"/>
        <to usec="0" sec="1270357309"/>
    </anomaly>
    <anomaly type="anomalous" value="1.944800,1.467980,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="205.20.65.219" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.657400,1.400280,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="143.196.217.150" src_port="80"/>
        </slice>
        <from usec="0" sec="1270357204"/>
        <to usec="0" sec="1270357579"/>
    </anomaly>
    <anomaly type="anomalous" value="2.860880,1.870150,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="76.181.220.225" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.622400,1.546970,010,1 1 0 0 0 0 1 1 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="182.53.228.141" dst_port="139"/>
            <filter src_ip="182.53.228.141" dst_port="445"/>
        </slice>
        <from usec="0" sec="1270357291"/>
        <to usec="0" sec="1270357382"/>
    </anomaly>
    <anomaly type="anomalous" value="2.047830,1.466150,011,0 0 0 1 1 1 1 1 1 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="177.17.205.112" src_port="4899"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.016150,1.397380,999,1 0 0 1 1 1 1 1 0 1 1 0,ipv46tun">
        <slice>
            <filter src_ip="192.101.185.40"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.697060,1.790400,999,1 1 1 1 1 1 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="205.20.176.159" dst_port="58584"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.926710,1.406140,503,0 0 0 1 1 1 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="205.20.74.246" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.789770,1.386550,503,0 0 0 1 1 1 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="173.40.177.113" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.697060,1.790400,999,1 1 1 1 1 1 1 1 1 1 0 0,ptmp">
        <slice>
            <filter src_ip="205.20.176.159" src_port="58584"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.944800,1.467980,503,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="143.196.110.79" dst_ip="4.153.86.24" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.130470,1.438210,010,1 0 0 0 0 0 0 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="19.129.38.30" dst_ip="205.20.73.129" proto="tcp"/>
        </slice>
        <from usec="0" sec="1270357470"/>
        <to usec="0" sec="1270357478"/>
    </anomaly>
    <anomaly type="suspicious" value="1.339040,1.431580,901,0 0 0 0 0 0 1 1 1 1 1 1,empty">
        <slice/>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.989974,1.348170,999,0 0 0 0 0 0 1 1 0 1 0 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.40.1.1" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.855943,1.282420,503,0 0 0 0 0 0 1 1 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="173.40.1.2" dst_port="53"/>
            <filter dst_ip="173.40.1.2" dst_port="80"/>
            <filter dst_ip="173.40.1.2"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.290060,1.361060,503,1 0 0 0 0 0 1 1 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="137.232.113.150" dst_ip="215.62.162.75" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.299750,1.436350,502,1 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="194.39.28.226" dst_port="22"/>
        </slice>
        <from usec="0" sec="1270357336"/>
        <to usec="0" sec="1270357864"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939415,1.325700,503,0 0 0 0 0 0 1 1 1 1 0 0,ntscACK">
        <slice>
            <filter src_ip="205.20.78.132" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.145250,1.370050,503,0 0 0 0 0 0 1 1 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="173.40.1.105" dst_ip="79.1.37.102" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.175430,1.433450,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="36.176.13.214" src_port="80"/>
            <filter dst_ip="36.176.13.219" src_port="80"/>
            <filter dst_ip="36.176.13.144" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.175430,1.433450,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="137.232.20.73" src_port="80"/>
            <filter dst_ip="42.238.47.43" src_port="80"/>
            <filter src_ip="143.196.110.21" dst_ip="42.238.47.43" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.175430,1.433450,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="173.40.180.185" dst_ip="216.106.167.197"/>
            <filter src_ip="173.40.180.185" dst_port="80"/>
            <filter src_ip="173.40.177.170" dst_ip="216.106.167.197" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.145250,1.370050,503,0 0 0 0 0 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="205.20.65.219" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.175430,1.433450,999,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="174.80.114.25" dst_port="36141"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.175430,1.433450,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="204.94.12.227" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.175430,1.433450,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="205.20.76.16" dst_ip="217.213.230.55"/>
            <filter src_ip="205.20.76.16" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
