<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.499370,1.953020,999,1 1 1 1 1 1 1 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="192.25.129.117" src_port="58584"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.317100,1.884580,010,1 1 1 1 1 1 0 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="8.218.86.16" src_port="63822" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.927690,1.774650,503,1 1 1 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="156.101.17.159" dst_port="80"/>
        </slice>
        <from usec="0" sec="1281243654"/>
        <to usec="0" sec="1281244436"/>
    </anomaly>
    <anomaly type="anomalous" value="1.921960,1.788160,502,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="192.25.100.157" src_port="22"/>
        </slice>
        <from usec="0" sec="1281243641"/>
        <to usec="0" sec="1281244443"/>
    </anomaly>
    <anomaly type="anomalous" value="1.921960,1.788160,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.183.53.252" dst_port="22"/>
        </slice>
        <from usec="0" sec="1281244420"/>
        <to usec="0" sec="1281244444"/>
    </anomaly>
    <anomaly type="anomalous" value="1.921960,1.788160,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="5.180.21.95" dst_port="25"/>
        </slice>
        <from usec="0" sec="1281243921"/>
        <to usec="0" sec="1281243934"/>
    </anomaly>
    <anomaly type="anomalous" value="1.267480,1.209120,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="173.181.37.132" dst_ip="212.145.156.194" src_port="80" dst_port="45226"/>
        </slice>
        <from usec="0" sec="1281243716"/>
        <to usec="0" sec="1281243723"/>
    </anomaly>
    <anomaly type="anomalous" value="1.366340,1.205370,503,0 0 0 1 1 1 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="173.181.18.2" dst_ip="212.145.156.33" src_port="80"/>
            <filter src_ip="173.181.18.2" dst_ip="33.153.84.204" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.764880,1.392260,999,1 1 0 1 1 1 1 0 0 1 0 0,ipv46tun">
        <slice>
            <filter src_ip="207.129.240.221"/>
            <filter src_ip="207.129.240.222"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.466890,1.249530,503,1 0 0 1 1 1 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="192.25.97.183" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.852330,1.743830,503,0 1 1 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="214.121.36.83" src_port="80"/>
        </slice>
        <from usec="0" sec="1281243936"/>
        <to usec="0" sec="1281244443"/>
    </anomaly>
    <anomaly type="anomalous" value="2.046980,1.629630,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="192.25.109.6" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.267480,1.209120,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="173.181.59.99" dst_ip="207.224.208.70" dst_port="53"/>
            <filter src_ip="173.181.59.99" dst_ip="33.153.84.212" src_port="80"/>
        </slice>
        <from usec="0" sec="1281243615"/>
        <to usec="0" sec="1281243877"/>
    </anomaly>
    <anomaly type="anomalous" value="1.366340,1.205370,503,0 0 0 1 1 1 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="169.139.97.214" dst_ip="212.145.156.228" src_port="80"/>
            <filter src_ip="156.101.17.158" dst_ip="212.145.156.228" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.267480,1.209120,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="176.153.116.44" dst_ip="212.145.156.57" src_port="80"/>
            <filter src_ip="176.153.79.47" dst_ip="212.145.156.57" src_port="80"/>
            <filter src_ip="156.101.96.83" dst_ip="212.145.156.57" src_port="80"/>
        </slice>
        <from usec="0" sec="1281243611"/>
        <to usec="0" sec="1281244067"/>
    </anomaly>
    <anomaly type="anomalous" value="1.901360,1.765830,010,0 0 0 1 1 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="40.23.73.17" src_port="80" dst_port="3072"/>
        </slice>
        <from usec="0" sec="1281243621"/>
        <to usec="0" sec="1281244097"/>
    </anomaly>
    <anomaly type="anomalous" value="1.267480,1.209120,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="173.181.244.51" dst_ip="33.153.84.74" src_port="80" dst_port="64557"/>
            <filter src_ip="173.181.244.51" dst_ip="33.153.84.74" src_port="80" dst_port="63959"/>
        </slice>
        <from usec="0" sec="1281244235"/>
        <to usec="0" sec="1281244288"/>
    </anomaly>
    <anomaly type="anomalous" value="3.239720,2.583030,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="15.139.70.86" src_port="6000" dst_port="2967"/>
            <filter src_ip="100.38.244.231" src_port="39654" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.366340,1.205370,503,0 0 0 1 1 1 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.139.98.146" dst_ip="32.210.151.157" src_port="80"/>
            <filter src_ip="169.139.98.146" dst_ip="33.153.81.164" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.267480,1.209120,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="176.153.196.115" dst_ip="33.153.81.25" src_port="80" dst_port="37900"/>
        </slice>
        <from usec="0" sec="1281244008"/>
        <to usec="0" sec="1281244019"/>
    </anomaly>
    <anomaly type="anomalous" value="1.366340,1.205370,503,0 0 0 1 1 1 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="193.25.26.104" dst_ip="212.145.156.238" src_port="80"/>
            <filter src_ip="173.181.114.251" dst_ip="212.145.156.238" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.606650,1.301150,503,0 0 0 1 1 1 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="168.70.91.145" dst_ip="212.145.156.1" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.606650,1.301150,503,0 0 0 1 1 1 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="176.153.21.66" dst_ip="33.153.81.200" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.259930,1.178830,503,0 0 0 1 0 0 1 1 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="156.101.17.209" dst_port="3124"/>
            <filter dst_ip="156.101.17.209"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.251150,1.199080,999,0 0 0 0 0 0 1 1 0 1 1 0,ptpposcaUDP">
        <slice>
            <filter src_ip="169.139.107.113" dst_ip="18.59.190.147" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.865780,1.568690,999,1 0 0 1 0 0 1 1 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="192.25.96.59" src_port="52287"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.339390,1.260920,503,1 1 0 1 0 0 0 1 0 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="156.101.17.159" dst_ip="99.78.171.42" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.016050,1.504630,503,1 1 0 1 1 1 1 1 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.25.97.183" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.817250,1.754030,999,1 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="53"/>
            <filter dst_ip="192.25.108.30" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244367"/>
    </anomaly>
    <anomaly type="anomalous" value="1.606650,1.301150,503,0 0 0 1 1 1 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="156.101.64.228" dst_ip="212.145.156.212" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.830300,1.422620,503,1 1 0 1 1 1 1 1 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.25.97.128" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.665990,1.514100,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="176.153.137.6" dst_ip="33.153.85.21" src_port="80"/>
            <filter src_ip="173.181.58.236" dst_ip="212.145.156.224" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.142150,1.662440,999,0 0 0 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="192.25.100.132" dst_port="53"/>
            <filter dst_ip="207.224.208.68" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.321280,1.765850,503,0 1 0 1 1 1 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="192.25.109.6" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.656740,1.309790,503,0 0 0 1 1 1 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="192.25.97.128" src_port="80"/>
            <filter src_ip="192.25.97.130" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.665990,1.514100,020,0 0 0 0 0 0 0 0 0 1 1 1,ntscICecrqICecrqdurmterp">
        <slice>
            <filter dst_ip="7.205.69.225"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.665990,1.514100,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="196.51.65.19" dst_ip="169.139.46.129" src_port="80"/>
            <filter src_ip="196.51.65.112" dst_ip="169.139.46.129" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.665990,1.514100,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="156.101.196.241" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.865780,1.568690,999,1 0 0 1 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="192.25.96.59"/>
            <filter src_ip="192.25.96.59" src_port="52287"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.046980,1.629630,503,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="173.164.110.164" dst_ip="212.145.156.36" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.665990,1.514100,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="192.25.97.140" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129750,1.249680,901,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="177.249.133.230" dst_ip="192.25.108.6" src_port="53"/>
        </slice>
        <from usec="0" sec="1281244112"/>
        <to usec="0" sec="1281244441"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129750,1.249680,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="193.189.25.177" dst_ip="169.139.36.48" src_port="54301" dst_port="25"/>
        </slice>
        <from usec="0" sec="1281244344"/>
        <to usec="0" sec="1281244347"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995712,1.205520,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="177.249.133.230" dst_ip="177.249.133.230" src_port="25573" proto="udp"/>
        </slice>
        <from usec="0" sec="1281243644"/>
        <to usec="0" sec="1281244444"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129750,1.249680,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="192.25.97.144" dst_ip="212.15.105.233" src_port="46458" dst_port="873"/>
            <filter src_ip="192.25.97.144" dst_ip="212.15.105.233" src_port="41509" dst_port="873"/>
            <filter src_ip="192.25.97.144" dst_ip="212.15.105.233" src_port="34705" dst_port="873"/>
        </slice>
        <from usec="0" sec="1281244427"/>
        <to usec="0" sec="1281244435"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129750,1.249680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="132.209.53.90" dst_port="135"/>
        </slice>
        <from usec="0" sec="1281244430"/>
        <to usec="0" sec="1281244442"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129750,1.249680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="6.61.84.22" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1281243896"/>
        <to usec="0" sec="1281243900"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129750,1.249680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="16.106.130.188" dst_port="445"/>
            <filter src_ip="16.106.130.188" dst_port="139"/>
        </slice>
        <from usec="0" sec="1281243650"/>
        <to usec="0" sec="1281243703"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129750,1.249680,502,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="195.122.234.201" dst_port="22"/>
        </slice>
        <from usec="0" sec="1281244337"/>
        <to usec="0" sec="1281244349"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129750,1.249680,502,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="193.104.187.95" dst_port="22"/>
        </slice>
        <from usec="0" sec="1281243810"/>
        <to usec="0" sec="1281243816"/>
    </anomaly>
    <anomaly type="suspicious" value="1.047130,1.144110,012,1 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="173.164.250.178" dst_ip="145.78.22.211" dst_port="443"/>
            <filter src_ip="173.164.250.8" dst_ip="145.78.22.211" dst_port="443"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281243704"/>
    </anomaly>
    <anomaly type="suspicious" value="0.960562,1.082840,503,1 0 0 1 0 0 1 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="214.121.36.83" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900881,1.095710,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="173.164.6.232" dst_ip="196.136.202.197" dst_port="80"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244429"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900881,1.095710,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="169.139.100.64" dst_ip="34.66.177.43" src_port="1127" dst_port="1863"/>
            <filter src_ip="169.139.145.48" dst_ip="34.66.177.43" src_port="49359" dst_port="1863"/>
        </slice>
        <from usec="0" sec="1281243626"/>
        <to usec="0" sec="1281244020"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900881,1.095710,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="173.164.110.207" dst_ip="44.132.201.21" dst_port="25"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900881,1.095710,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="156.101.239.1" dst_ip="170.215.250.220" dst_port="80"/>
        </slice>
        <from usec="0" sec="1281243632"/>
        <to usec="0" sec="1281244413"/>
    </anomaly>
    <anomaly type="suspicious" value="0.935641,1.146820,999,1 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="192.25.96.55" dst_port="3124"/>
            <filter dst_ip="192.25.96.55" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244436"/>
    </anomaly>
    <anomaly type="suspicious" value="0.782687,1.076400,503,0 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="193.19.164.158" src_port="53"/>
            <filter src_ip="193.157.152.89" dst_ip="193.19.164.158" src_port="80"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281243889"/>
    </anomaly>
    <anomaly type="suspicious" value="0.935641,1.146820,999,1 0 0 0 0 0 1 1 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="18.59.190.147" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244478"/>
    </anomaly>
    <anomaly type="suspicious" value="0.782687,1.076400,999,0 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="39.204.36.36" dst_port="53"/>
            <filter src_ip="156.101.35.147" dst_ip="193.4.11.197" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199910,1.258670,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="192.25.117.96" dst_port="445"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244499"/>
    </anomaly>
    <anomaly type="suspicious" value="0.922459,1.094400,999,0 0 0 0 0 0 1 1 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.25.107.83" dst_port="45552"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="193.216.62.100" dst_ip="134.45.42.36" src_port="53"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="158.149.195.215" src_port="53"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="1.100110,1.143940,999,0 0 0 1 1 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="193.4.11.197" dst_ip="156.101.35.147" src_port="53"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="156.101.17.217"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.922459,1.094400,503,0 0 0 0 0 0 1 1 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.25.97.129" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.782687,1.076400,503,0 0 0 1 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.25.97.131" dst_port="80"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244429"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.164.146.119" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="156.101.17.147" dst_port="80"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281243647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="169.139.128.221" dst_ip="206.97.131.188" src_port="123"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281243647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.25.100.132" src_port="53"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281243647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.25.108.28" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281243647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="169.139.128.221" dst_ip="134.2.83.36" src_port="123"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281243647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.164.110.200" src_port="53"/>
            <filter dst_ip="173.164.110.200" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281243647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="169.139.128.221" dst_ip="18.132.157.184" src_port="123"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281243647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="221.28.52.255"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281243647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="169.139.128.221" dst_ip="192.80.66.73" src_port="123"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281243647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="169.139.128.221" dst_ip="192.80.66.78" src_port="123"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281243647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,010,0 0 0 0 0 0 1 1 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="57.242.26.49" src_port="2357" dst_port="222"/>
        </slice>
        <from usec="0" sec="1281244006"/>
        <to usec="0" sec="1281244052"/>
    </anomaly>
    <anomaly type="suspicious" value="1.730740,1.736770,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="96.5.203.219" src_port="2434" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1281244006"/>
        <to usec="0" sec="1281244052"/>
    </anomaly>
    <anomaly type="suspicious" value="1.730740,1.736770,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="15.137.192.176" src_port="3411" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1281244006"/>
        <to usec="0" sec="1281244052"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="169.139.173.17" src_port="53"/>
            <filter dst_ip="169.139.173.17" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281244096"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="193.25.27.33" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281244096"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="193.18.178.33" dst_ip="156.101.142.210" dst_port="80"/>
        </slice>
        <from usec="0" sec="1281244096"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="199.112.134.1" dst_ip="158.149.195.214" src_port="53"/>
            <filter src_ip="197.206.240.143" dst_ip="158.149.195.214" src_port="53"/>
        </slice>
        <from usec="0" sec="1281244096"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.782687,1.076400,999,0 0 0 1 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="192.25.106.76" dst_ip="37.192.218.115" dst_port="53"/>
            <filter src_ip="192.25.109.151" dst_ip="37.192.218.115" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244429"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="192.25.109.151" dst_ip="37.192.220.130" dst_port="53"/>
            <filter src_ip="192.25.106.76" dst_ip="37.192.220.130" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281244096"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="187.138.104.13" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281244096"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="156.101.17.147" dst_port="80"/>
        </slice>
        <from usec="0" sec="1281244096"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="193.106.189.1" dst_ip="193.19.165.118" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="192.25.108.6" src_port="53"/>
            <filter dst_ip="192.25.108.6" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281244096"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="173.164.113.100" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281244096"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="169.139.128.221" dst_ip="134.97.41.210" src_port="123"/>
        </slice>
        <from usec="0" sec="1281244096"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.25.108.28" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281244096"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="156.101.17.216" dst_port="33430"/>
            <filter dst_ip="156.101.17.216"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="193.25.191.94" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281244096"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.164.110.200" src_port="53"/>
            <filter dst_ip="173.164.110.200" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281244096"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="193.216.62.100" dst_ip="159.49.228.15" src_port="53"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="193.216.62.100" dst_ip="198.192.20.233" src_port="53"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.25.104.31" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281243601"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="173.164.66.128" dst_ip="215.84.51.32" dst_port="53"/>
        </slice>
        <from usec="0" sec="1281244006"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="1.730740,1.736770,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="40.23.73.17" src_port="80" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1281244006"/>
        <to usec="0" sec="1281244412"/>
    </anomaly>
    <anomaly type="suspicious" value="1.730740,1.736770,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="219.0.161.42" src_port="1156" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1281244006"/>
        <to usec="0" sec="1281244052"/>
    </anomaly>
    <anomaly type="suspicious" value="1.730740,1.736770,999,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="5060" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1281244006"/>
        <to usec="0" sec="1281244052"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858578,1.094580,999,1 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="49.60.124.229" dst_ip="156.101.215.170" src_port="61662" dst_port="1034"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.871329,1.072360,503,1 0 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.139.176.35" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080140,1.153160,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="46.44.171.7" dst_ip="156.101.156.66" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768466,1.098540,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="156.101.17.209"/>
        </slice>
        <from usec="0" sec="1281243736"/>
        <to usec="0" sec="1281244142"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080140,1.153160,999,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="193.18.152.250" dst_ip="193.25.20.47" src_port="80" dst_port="58881"/>
            <filter src_ip="193.18.152.250" dst_ip="193.25.20.47" src_port="80" dst_port="58880"/>
            <filter src_ip="88.252.21.170" dst_ip="193.25.20.47" src_port="80" dst_port="58877"/>
            <filter src_ip="88.252.21.170" dst_ip="193.25.20.47" src_port="8102" dst_port="62498"/>
            <filter src_ip="5.74.188.165" dst_ip="193.25.20.47" src_port="1050" dst_port="62498"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080140,1.153160,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.25.111.122" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080140,1.153160,501,0 0 0 0 0 0 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="176.153.133.25" dst_ip="33.153.81.166" src_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.080140,1.153160,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="168.70.166.89" dst_ip="33.153.84.58" src_port="80"/>
            <filter src_ip="192.25.104.31" dst_ip="33.153.84.58" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.090310,1.132090,503,0 0 0 1 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="32.210.223.200" src_port="53"/>
            <filter src_ip="192.25.111.122" dst_ip="32.210.223.200" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
