<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="4.449970,3.404370,999,1 1 1 1 1 1 1 1 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="196.200.40.228" src_port="58584"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.492860,1.878930,503,1 1 0 1 1 0 1 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="174.81.177.168" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.346690,1.879080,503,1 1 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="174.81.42.64" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.396440,1.864980,503,1 1 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="196.200.205.39"/>
            <filter dst_ip="197.85.192.55"/>
            <filter dst_ip="196.200.205.54"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.211350,2.390080,010,1 1 1 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="213.175.67.173" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.827610,2.725990,503,1 1 1 1 1 1 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="85.68.55.62" dst_ip="174.81.32.220" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.793830,2.361350,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="214.214.103.150" src_port="135" dst_port="8888"/>
            <filter dst_ip="214.214.103.150" src_port="1433" dst_port="8888"/>
        </slice>
        <from usec="0" sec="1278478880"/>
        <to usec="0" sec="1278478882"/>
    </anomaly>
    <anomaly type="anomalous" value="2.991480,2.324470,503,1 1 1 1 1 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="141.33.64.16" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.846080,3.177460,010,1 1 1 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="109.173.71.83" dst_port="22"/>
        </slice>
        <from usec="0" sec="1278479656"/>
        <to usec="0" sec="1278479702"/>
    </anomaly>
    <anomaly type="anomalous" value="2.678480,2.146340,503,0 0 0 1 1 1 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="197.85.44.157" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.175020,2.279630,503,1 1 0 1 1 1 1 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="174.81.177.172" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.092640,1.780120,503,1 1 0 1 1 0 1 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="197.85.44.157" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.871510,2.198900,999,1 1 0 1 1 1 1 0 0 1 0 0,ipv46tun">
        <slice>
            <filter src_ip="200.119.66.50"/>
            <filter src_ip="200.119.66.48"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.024450,3.689210,010,1 1 1 1 1 1 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="214.214.103.150" src_port="8888" dst_port="135"/>
            <filter src_ip="214.214.103.150" src_port="8888" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.024450,3.689210,999,1 1 1 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="141.33.93.158"/>
            <filter src_ip="196.200.192.43" dst_ip="132.12.188.48"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.310640,2.060400,503,0 0 0 1 1 1 0 0 0 1 0 0,malphfl">
        <slice>
            <filter src_ip="208.50.154.120" dst_ip="174.81.138.20" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.328990,3.031940,010,1 1 1 1 1 1 1 0 0 1 1 1,poscaSYN">
        <slice>
            <filter src_ip="132.12.188.48" dst_ip="141.33.93.158"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.102620,2.077220,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="184.13.76.36" dst_port="53"/>
            <filter src_ip="184.13.76.36" dst_ip="83.41.157.34" src_port="80"/>
        </slice>
        <from usec="0" sec="1278478817"/>
        <to usec="0" sec="1278479532"/>
    </anomaly>
    <anomaly type="anomalous" value="3.283580,2.503150,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="197.90.189.121" src_port="80"/>
            <filter dst_ip="197.90.189.121" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.629730,2.144630,503,0 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="174.81.32.220" dst_port="80"/>
            <filter dst_ip="80.238.244.184" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.102620,2.077220,503,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="83.69.108.132" dst_ip="169.56.203.241" src_port="22" dst_port="55961"/>
            <filter src_ip="83.69.108.132" dst_ip="169.56.203.241" src_port="22" dst_port="55958"/>
            <filter src_ip="221.0.179.28" dst_ip="169.56.203.241" src_port="80" dst_port="55857"/>
            <filter src_ip="221.0.179.28" dst_ip="174.81.88.171" src_port="80" dst_port="28651"/>
        </slice>
        <from usec="0" sec="1278478801"/>
        <to usec="0" sec="1278479629"/>
    </anomaly>
    <anomaly type="anomalous" value="2.678480,2.146340,503,0 0 0 1 1 1 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="184.13.44.210" dst_ip="83.41.153.128" src_port="80"/>
            <filter src_ip="169.232.64.64" dst_ip="83.41.153.128" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.283580,2.503150,999,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="197.85.44.243" dst_port="31830"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.787320,2.198910,503,1 0 0 0 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="141.33.93.157" dst_port="80"/>
            <filter dst_ip="141.33.93.157" dst_port="53"/>
            <filter dst_ip="141.33.93.157"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.328990,3.031940,010,1 1 1 1 1 1 1 0 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="132.12.188.48" dst_ip="196.200.192.43"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.827310,2.762150,010,1 1 1 0 0 0 1 0 0 1 1 1,poscaSYN">
        <slice>
            <filter src_ip="132.12.188.48" dst_ip="196.200.192.34"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.356510,2.422250,503,1 1 1 1 1 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="196.200.193.24" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.704820,2.696660,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="97.226.109.190" src_port="14602"/>
        </slice>
        <from usec="0" sec="1278478891"/>
        <to usec="0" sec="1278478937"/>
    </anomaly>
    <anomaly type="anomalous" value="2.704820,2.696660,002,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="83.127.175.160" src_port="1028" dst_port="137"/>
            <filter src_ip="76.85.16.170" src_port="1028" dst_port="137"/>
        </slice>
        <from usec="0" sec="1278478891"/>
        <to usec="0" sec="1278478937"/>
    </anomaly>
    <anomaly type="anomalous" value="2.704820,2.696660,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="169.240.54.40" src_port="26972"/>
        </slice>
        <from usec="0" sec="1278479206"/>
        <to usec="0" sec="1278479387"/>
    </anomaly>
    <anomaly type="anomalous" value="2.704820,2.696660,999,0 0 0 0 0 0 1 1 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="169.240.114.76" dst_ip="83.92.200.141" dst_port="53"/>
        </slice>
        <from usec="0" sec="1278479431"/>
        <to usec="0" sec="1278479477"/>
    </anomaly>
    <anomaly type="anomalous" value="2.826330,2.654610,503,0 0 0 1 0 0 1 1 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="141.33.93.159" dst_port="53"/>
            <filter dst_ip="141.33.93.159"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.283580,2.503150,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="193.216.205.71" dst_ip="174.81.192.176" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.586510,2.168550,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="44.190.45.27" dst_ip="174.81.42.64" src_port="80"/>
            <filter src_ip="42.133.109.100" dst_ip="174.81.42.64" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.699480,2.175460,503,1 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="141.33.9.20" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.699480,2.175460,999,1 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="197.85.44.243"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.586510,2.168550,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="174.81.177.173" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.586510,2.168550,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="174.81.136.123" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.755680,1.744600,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="200.128.91.155" dst_ip="169.56.137.160" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.755680,1.744600,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.240.9.232" src_port="80"/>
            <filter dst_ip="169.240.9.232" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.328990,3.031940,503,1 1 1 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="197.90.189.121" dst_port="80"/>
            <filter src_ip="197.90.189.121" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.755680,1.744600,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="174.81.169.196" dst_ip="120.176.193.253" src_port="80"/>
            <filter src_ip="174.81.37.202" dst_ip="120.176.193.253" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.203370,2.083530,503,0 0 0 0 0 0 0 0 0 1 0 1,ptmplaHTTP">
        <slice>
            <filter src_ip="167.241.108.190" dst_ip="196.200.205.148" src_port="80" dst_port="41205"/>
            <filter src_ip="167.241.108.190" dst_ip="196.200.204.46" src_port="80" dst_port="29518"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.586510,2.168550,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="174.81.182.169" dst_ip="208.227.227.161" src_port="80"/>
            <filter src_ip="174.81.182.131" dst_ip="208.227.227.161" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.726020,1.770830,503,1 1 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="197.85.41.125" dst_ip="197.91.143.20" dst_port="80"/>
        </slice>
        <from usec="0" sec="1278478801"/>
        <to usec="0" sec="1278479688"/>
    </anomaly>
    <anomaly type="suspicious" value="1.659420,1.799730,503,1 1 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="141.33.165.39" dst_ip="132.221.196.28" src_port="50605" dst_port="80"/>
            <filter src_ip="141.33.165.39" dst_ip="203.84.4.197" src_port="61936" dst_port="38930"/>
            <filter src_ip="174.81.177.172" dst_ip="132.221.196.28" src_port="53536" dst_port="80"/>
        </slice>
        <from usec="0" sec="1278478934"/>
        <to usec="0" sec="1278479681"/>
    </anomaly>
    <anomaly type="suspicious" value="1.726020,1.770830,999,1 1 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="196.200.196.33" dst_ip="221.0.176.117" src_port="64303" dst_port="873"/>
            <filter src_ip="196.200.196.33" dst_ip="221.0.176.117" src_port="55861" dst_port="873"/>
        </slice>
        <from usec="0" sec="1278478801"/>
        <to usec="0" sec="1278479684"/>
    </anomaly>
    <anomaly type="suspicious" value="1.659420,1.799730,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="196.200.193.36" dst_port="80"/>
        </slice>
        <from usec="0" sec="1278479192"/>
        <to usec="0" sec="1278479684"/>
    </anomaly>
    <anomaly type="suspicious" value="1.659420,1.799730,504,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="173.92.89.181" dst_ip="169.240.20.131" src_port="443"/>
        </slice>
        <from usec="0" sec="1278479458"/>
        <to usec="0" sec="1278479494"/>
    </anomaly>
    <anomaly type="suspicious" value="1.659420,1.799730,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="147.43.74.31" dst_port="139"/>
        </slice>
        <from usec="0" sec="1278479457"/>
        <to usec="0" sec="1278479504"/>
    </anomaly>
    <anomaly type="suspicious" value="1.659420,1.799730,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="174.81.107.198" dst_port="80"/>
        </slice>
        <from usec="0" sec="1278479667"/>
        <to usec="0" sec="1278479673"/>
    </anomaly>
    <anomaly type="suspicious" value="1.659420,1.799730,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="141.33.93.200" dst_port="80"/>
        </slice>
        <from usec="0" sec="1278478855"/>
        <to usec="0" sec="1278479688"/>
    </anomaly>
    <anomaly type="suspicious" value="1.659420,1.799730,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="196.200.206.167" dst_ip="173.92.89.10" dst_port="443"/>
        </slice>
        <from usec="0" sec="1278479679"/>
        <to usec="0" sec="1278479681"/>
    </anomaly>
    <anomaly type="suspicious" value="1.659420,1.799730,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="107.137.86.44" dst_port="445"/>
            <filter src_ip="107.137.86.44" dst_port="139"/>
        </slice>
        <from usec="0" sec="1278478962"/>
        <to usec="0" sec="1278479005"/>
    </anomaly>
    <anomaly type="suspicious" value="1.659420,1.799730,502,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="47.24.87.47" dst_port="22"/>
        </slice>
        <from usec="0" sec="1278479346"/>
        <to usec="0" sec="1278479352"/>
    </anomaly>
    <anomaly type="suspicious" value="1.659420,1.799730,502,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="212.195.0.245" dst_port="22"/>
        </slice>
        <from usec="0" sec="1278478984"/>
        <to usec="0" sec="1278478990"/>
    </anomaly>
    <anomaly type="suspicious" value="1.798790,1.828020,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="107.137.117.99" dst_port="445"/>
            <filter src_ip="107.137.117.99" dst_port="139"/>
        </slice>
        <from usec="0" sec="1278478891"/>
        <to usec="0" sec="1278478946"/>
    </anomaly>
    <anomaly type="suspicious" value="1.659420,1.799730,502,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="219.140.162.34" dst_port="22"/>
        </slice>
        <from usec="0" sec="1278479652"/>
        <to usec="0" sec="1278479662"/>
    </anomaly>
    <anomaly type="suspicious" value="1.659420,1.799730,502,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="203.37.202.153" dst_port="22"/>
        </slice>
        <from usec="0" sec="1278479461"/>
        <to usec="0" sec="1278479472"/>
    </anomaly>
    <anomaly type="suspicious" value="1.726020,1.770830,503,1 1 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="169.56.203.241" dst_ip="221.0.179.28" src_port="55857" dst_port="80"/>
            <filter src_ip="174.81.88.171" dst_ip="221.0.179.28" src_port="28651" dst_port="80"/>
        </slice>
        <from usec="0" sec="1278478801"/>
        <to usec="0" sec="1278479684"/>
    </anomaly>
    <anomaly type="suspicious" value="1.438680,1.615210,503,1 0 0 1 1 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="196.200.193.24" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.398080,1.637540,999,0 0 0 1 1 0 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="197.85.220.210" dst_port="10843"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.398080,1.637540,503,0 0 0 1 1 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.238.211.128" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.525220,1.677710,503,1 0 0 0 0 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="141.33.93.147"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.672640,1.693200,503,1 0 0 0 1 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter src_ip="136.192.2.151" dst_ip="196.200.201.241"/>
            <filter dst_ip="196.200.201.241" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.658960,2.667690,999,0 0 0 1 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.7.6.19" src_port="53"/>
        </slice>
        <from usec="0" sec="1278478803"/>
        <to usec="0" sec="1278479702"/>
    </anomaly>
    <anomaly type="suspicious" value="1.358070,1.646840,504,1 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="174.81.163.232" src_port="26916"/>
            <filter src_ip="174.81.163.232" dst_ip="132.3.9.196" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.684180,1.699480,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="174.81.155.73" dst_ip="209.180.33.74" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.398080,1.637540,999,0 0 0 1 1 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="174.81.125.135" src_port="123"/>
            <filter src_ip="174.81.125.135" dst_port="123"/>
            <filter src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116790,1.637710,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.232.228.67"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.684180,1.699480,503,0 0 0 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="196.200.193.36" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.684180,1.699480,504,0 0 0 1 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="169.240.132.27" dst_ip="132.209.47.200" src_port="50847" dst_port="443"/>
            <filter src_ip="141.33.193.138" dst_ip="132.209.47.200" src_port="61975" dst_port="443"/>
            <filter src_ip="174.81.115.78" dst_ip="132.209.47.200" src_port="1064" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.213540,1.605900,999,0 0 0 1 1 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="197.85.220.210" src_port="10843"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116790,1.637710,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="221.0.176.117"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116790,1.637710,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="223.10.73.1"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116790,1.637710,503,0 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="174.81.177.172"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116790,1.637710,503,0 0 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="194.168.112.168" src_port="80"/>
            <filter dst_ip="141.33.192.107" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116790,1.637710,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="141.33.194.131"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116790,1.637710,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="197.5.191.31"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116790,1.637710,503,0 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="197.85.42.92"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.684180,1.699480,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="196.200.193.36" dst_ip="197.229.12.201" src_port="80" dst_port="2459"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116790,1.637710,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="213.172.8.47"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116790,1.637710,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="45.60.205.46"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116790,1.637710,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="77.13.213.4"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.358070,1.646840,503,1 0 0 0 0 0 0 0 0 1 0 0,salphfl">
        <slice>
            <filter src_ip="174.81.122.165" dst_ip="120.140.173.221" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.471180,1.764440,503,0 0 0 0 0 0 0 0 0 0 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="167.241.108.190" dst_ip="196.200.205.148" src_port="80" dst_port="41205"/>
            <filter src_ip="167.241.108.190" dst_ip="196.200.204.46" src_port="80" dst_port="29518"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.684180,1.699480,503,0 0 0 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="196.200.201.241" dst_ip="136.192.2.151"/>
            <filter src_ip="196.200.201.241" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
