<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.144490,1.928350,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="199.56.58.133" dst_ip="223.203.93.228" src_port="60483" dst_port="25"/>
        </slice>
        <from usec="0" sec="1284008745"/>
        <to usec="0" sec="1284008750"/>
    </anomaly>
    <anomaly type="anomalous" value="2.144490,1.928350,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="197.190.174.185" dst_port="22"/>
        </slice>
        <from usec="0" sec="1284008743"/>
        <to usec="0" sec="1284008798"/>
    </anomaly>
    <anomaly type="anomalous" value="3.042680,2.264340,010,1 1 1 1 1 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="69.185.43.14" src_port="6000" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.422190,1.345540,999,1 1 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="199.56.39.144" dst_ip="69.34.100.245" src_port="1061" dst_port="1047"/>
        </slice>
        <from usec="0" sec="1284008401"/>
        <to usec="0" sec="1284008793"/>
    </anomaly>
    <anomaly type="anomalous" value="1.801820,1.492930,503,1 1 0 1 1 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.56.52.83" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.805700,1.477240,503,1 1 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="148.36.153.48" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.144490,1.928350,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="65.65.1.40" src_port="6000" dst_port="2967"/>
        </slice>
        <from usec="0" sec="1284008905"/>
        <to usec="0" sec="1284008906"/>
    </anomaly>
    <anomaly type="anomalous" value="3.225000,2.326320,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="65.90.40.95" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.144490,1.928350,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="33.240.154.245" dst_port="10000"/>
        </slice>
        <from usec="0" sec="1284008827"/>
        <to usec="0" sec="1284008882"/>
    </anomaly>
    <anomaly type="anomalous" value="2.144490,1.928350,020,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="28.15.85.39"/>
        </slice>
        <from usec="0" sec="1284009075"/>
        <to usec="0" sec="1284009079"/>
    </anomaly>
    <anomaly type="anomalous" value="2.257340,1.987370,503,1 1 1 1 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="167.190.180.106" dst_port="80"/>
        </slice>
        <from usec="0" sec="1284008401"/>
        <to usec="0" sec="1284008869"/>
    </anomaly>
    <anomaly type="anomalous" value="2.323440,1.645250,503,1 1 0 1 1 1 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="167.190.180.106" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.874960,2.104230,010,1 1 1 1 1 1 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="217.23.80.229" src_port="12200" dst_port="8085"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.560690,1.452600,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="148.52.52.219" dst_ip="33.73.177.190" src_port="80" dst_port="50577"/>
        </slice>
        <from usec="0" sec="1284008401"/>
        <to usec="0" sec="1284009048"/>
    </anomaly>
    <anomaly type="anomalous" value="1.991100,1.514820,503,0 0 0 1 1 1 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="145.105.76.38" dst_ip="209.160.67.151" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.469760,1.810710,999,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="131.60.232.180" dst_ip="209.160.67.97"/>
            <filter src_ip="131.60.232.180" dst_ip="33.73.176.41"/>
            <filter src_ip="131.60.232.180" src_port="21"/>
            <filter dst_ip="209.160.67.97" src_port="80"/>
            <filter dst_ip="33.73.176.41" src_port="21"/>
            <filter src_ip="131.60.232.180" dst_ip="33.73.176.1" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.991100,1.514820,999,0 0 0 1 1 1 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="42.241.68.24" dst_port="995"/>
            <filter dst_ip="42.241.68.24" dst_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.651360,1.495880,999,1 1 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="167.190.180.19"/>
            <filter src_ip="199.56.53.107"/>
            <filter src_ip="167.190.180.28" src_port="3124"/>
        </slice>
        <from usec="0" sec="1284008401"/>
        <to usec="0" sec="1284009120"/>
    </anomaly>
    <anomaly type="anomalous" value="3.225000,2.326320,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="27.212.64.68" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.991100,1.514820,503,0 0 0 1 1 1 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="131.60.132.192" dst_ip="33.73.182.146" src_port="80" dst_port="47270"/>
            <filter src_ip="131.60.132.192" dst_ip="33.73.182.146" src_port="80" dst_port="43938"/>
            <filter src_ip="131.60.132.192" dst_ip="42.241.80.87" src_port="80" dst_port="43955"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.555260,1.824820,503,1 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="198.45.59.97" src_port="80"/>
            <filter src_ip="148.196.88.216" dst_ip="198.45.59.97" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.469760,1.810710,501,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="28.13.55.11" dst_ip="148.48.144.217" src_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.689560,1.938340,503,1 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="199.56.52.98" dst_port="80"/>
            <filter dst_ip="199.56.52.96" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.302860,2.036100,999,1 1 1 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="199.56.58.91" dst_port="53"/>
        </slice>
        <from usec="0" sec="1284008444"/>
        <to usec="0" sec="1284009031"/>
    </anomaly>
    <anomaly type="anomalous" value="1.497420,1.366740,999,1 0 0 1 1 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_port="53"/>
            <filter src_ip="203.54.47.9" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.821450,2.159050,999,1 1 1 1 1 1 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="199.56.140.249" src_port="58584"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.821450,2.159050,999,1 1 1 1 1 1 1 0 0 1 0 0,ipv46tun">
        <slice>
            <filter src_ip="203.115.156.227"/>
            <filter src_ip="203.115.156.224"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.272410,1.254590,503,0 0 0 1 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="148.52.132.224" dst_ip="209.160.67.144" src_port="80"/>
            <filter src_ip="148.52.132.224" dst_ip="198.74.171.54" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.608460,1.925060,999,0 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="199.56.53.107"/>
            <filter dst_ip="167.190.180.19"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.062930,1.556370,503,1 1 0 1 1 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="198.45.59.97" dst_port="80"/>
            <filter src_ip="198.32.104.161" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.469760,1.810710,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="199.56.56.17" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.744750,1.921160,503,1 1 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="199.56.56.17" src_port="34538"/>
            <filter src_ip="199.56.56.17" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.062930,1.556370,503,1 1 0 1 1 0 1 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="145.105.69.127" dst_ip="198.33.193.110" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.320920,1.745110,503,1 0 0 1 1 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="199.56.61.139" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.502090,1.349580,503,1 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="32.13.116.133" dst_ip="199.56.62.48" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.469760,1.810710,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="148.36.153.48" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.990440,1.659540,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="167.190.112.134" dst_port="80"/>
            <filter src_ip="167.190.112.134" dst_ip="169.37.71.197" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.272410,1.254590,020,0 0 0 1 0 0 0 0 0 1 1 0,ntscICec">
        <slice>
            <filter src_ip="21.34.176.64"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.351520,1.330440,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="131.60.141.100" dst_port="53"/>
            <filter src_ip="131.60.141.100" dst_ip="33.73.181.169" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.469760,1.810710,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="199.56.61.139" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.272410,1.254590,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="199.56.62.48" dst_ip="32.13.116.133" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.160740,1.649810,999,0 0 0 1 1 1 1 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="199.56.48.33" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.351520,1.330440,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="208.2.231.209" dst_ip="145.105.102.24" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.225000,2.326320,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="221.127.147.29" src_port="6000" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.351520,1.330440,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="167.190.54.31" src_port="53"/>
            <filter dst_ip="167.190.54.31" src_port="80"/>
            <filter dst_ip="167.190.54.31" src_port="3478"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.320920,1.745110,503,1 0 0 1 1 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="198.32.104.161" src_port="53"/>
            <filter dst_ip="198.32.104.161" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.351520,1.330440,999,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="198.45.150.251" dst_port="14557"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.351520,1.330440,999,0 0 0 0 0 0 0 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="198.32.87.12" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.351520,1.330440,504,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="145.105.34.186" dst_ip="194.35.108.29" src_port="1037" dst_port="443"/>
            <filter src_ip="145.105.20.131" dst_ip="194.35.108.29" src_port="49185" dst_port="443"/>
            <filter src_ip="148.175.208.227" dst_ip="194.35.108.29" src_port="52543" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.469760,1.810710,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="33.73.181.51" src_port="80"/>
            <filter src_ip="148.52.208.78" dst_ip="209.160.67.187" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.062200,1.602170,503,0 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="145.105.83.249" src_port="80"/>
            <filter dst_ip="209.160.67.183" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.351520,1.330440,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="131.60.224.55" dst_ip="33.73.177.74" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.937600,1.599380,503,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="145.105.141.74" dst_port="80"/>
            <filter src_ip="145.105.141.74" dst_port="53"/>
            <filter dst_ip="35.104.164.63" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="145.105.76.10" dst_ip="195.64.171.163" src_port="2090" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1284008793"/>
        <to usec="0" sec="1284008795"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="223.17.89.37" dst_ip="167.190.108.73" src_port="80" dst_port="51683" proto="tcp"/>
        </slice>
        <from usec="0" sec="1284009241"/>
        <to usec="0" sec="1284009246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="198.45.151.122"/>
        </slice>
        <from usec="0" sec="1284009239"/>
        <to usec="0" sec="1284009241"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="145.105.45.164" dst_ip="32.13.42.8" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1284009256"/>
        <to usec="0" sec="1284009260"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="145.105.67.166" dst_ip="205.1.116.201" src_port="4832" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1284008758"/>
        <to usec="0" sec="1284008762"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="40.254.89.114" dst_ip="148.36.213.131" src_port="80" dst_port="1873" proto="tcp"/>
        </slice>
        <from usec="0" sec="1284009075"/>
        <to usec="0" sec="1284009077"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="145.105.55.135" dst_ip="118.80.198.49" src_port="51683" dst_port="143" proto="tcp"/>
        </slice>
        <from usec="0" sec="1284008751"/>
        <to usec="0" sec="1284008768"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="106.6.67.193"/>
        </slice>
        <from usec="0" sec="1284008746"/>
        <to usec="0" sec="1284008790"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="145.105.224.26" dst_ip="186.22.17.82" src_port="57723" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1284008752"/>
        <to usec="0" sec="1284008754"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="148.36.165.119" dst_ip="223.169.235.221" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1284008782"/>
        <to usec="0" sec="1284008787"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="209.160.2.44"/>
        </slice>
        <from usec="0" sec="1284008775"/>
        <to usec="0" sec="1284008777"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="145.105.138.114" dst_ip="192.62.176.54" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1284008742"/>
        <to usec="0" sec="1284009244"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="167.190.108.103"/>
        </slice>
        <from usec="0" sec="1284008451"/>
        <to usec="0" sec="1284008790"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="148.52.89.232"/>
        </slice>
        <from usec="0" sec="1284008793"/>
        <to usec="0" sec="1284008795"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="204.41.140.33"/>
        </slice>
        <from usec="0" sec="1284008785"/>
        <to usec="0" sec="1284008787"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="213.193.198.31" src_port="52809" proto="tcp"/>
        </slice>
        <from usec="0" sec="1284008788"/>
        <to usec="0" sec="1284008793"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="69.34.100.245" dst_ip="199.56.39.144" src_port="1047" dst_port="1061" proto="udp"/>
        </slice>
        <from usec="0" sec="1284008753"/>
        <to usec="0" sec="1284008798"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="148.36.100.55"/>
        </slice>
        <from usec="0" sec="1284008748"/>
        <to usec="0" sec="1284008750"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="145.105.79.72" dst_ip="198.33.245.60" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1284008751"/>
        <to usec="0" sec="1284008753"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="167.190.239.244"/>
        </slice>
        <from usec="0" sec="1284009254"/>
        <to usec="0" sec="1284009256"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="145.105.80.77" dst_ip="203.57.151.28" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1284008573"/>
        <to usec="0" sec="1284008783"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="167.190.109.86"/>
        </slice>
        <from usec="0" sec="1284008758"/>
        <to usec="0" sec="1284008787"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="167.190.180.98" dst_port="80"/>
        </slice>
        <from usec="0" sec="1284008752"/>
        <to usec="0" sec="1284008797"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="173.251.243.97"/>
        </slice>
        <from usec="0" sec="1284008775"/>
        <to usec="0" sec="1284008777"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="164.12.138.187"/>
        </slice>
        <from usec="0" sec="1284008702"/>
        <to usec="0" sec="1284008704"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,010,1 0 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="185.154.200.206" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1284008447"/>
        <to usec="0" sec="1284009028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,999,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="167.190.225.175"/>
        </slice>
        <from usec="0" sec="1284008790"/>
        <to usec="0" sec="1284008793"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="45.6.225.245"/>
        </slice>
        <from usec="0" sec="1284008514"/>
        <to usec="0" sec="1284008517"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="198.45.157.0"/>
        </slice>
        <from usec="0" sec="1284009026"/>
        <to usec="0" sec="1284009028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852979,1.279350,999,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="167.190.225.157" dst_ip="42.241.68.84" src_port="56500" dst_port="25"/>
            <filter src_ip="199.56.61.75" dst_ip="42.241.68.84" src_port="50756" dst_port="25"/>
            <filter src_ip="145.105.168.48" dst_ip="42.241.68.84" src_port="38347" dst_port="25"/>
            <filter src_ip="145.105.187.180" dst_ip="42.241.68.84" src_port="48831" dst_port="25"/>
        </slice>
        <from usec="0" sec="1284008753"/>
        <to usec="0" sec="1284008797"/>
    </anomaly>
    <anomaly type="suspicious" value="1.315990,1.413370,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="145.105.74.85" dst_ip="35.105.149.81" src_port="59257" dst_port="80"/>
        </slice>
        <from usec="0" sec="1284008479"/>
        <to usec="0" sec="1284009240"/>
    </anomaly>
    <anomaly type="suspicious" value="1.315990,1.413370,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="145.105.42.232" dst_ip="8.177.160.36" src_port="6164" dst_port="80"/>
        </slice>
        <from usec="0" sec="1284008758"/>
        <to usec="0" sec="1284008798"/>
    </anomaly>
    <anomaly type="suspicious" value="1.315990,1.413370,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="148.36.34.4" dst_ip="35.105.149.62" src_port="49498" dst_port="80"/>
        </slice>
        <from usec="0" sec="1284008872"/>
        <to usec="0" sec="1284008876"/>
    </anomaly>
    <anomaly type="suspicious" value="1.315990,1.413370,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="145.105.189.34" dst_ip="200.197.37.8" src_port="3841" dst_port="80"/>
            <filter src_ip="145.105.189.34" dst_ip="200.197.37.8" src_port="3735" dst_port="80"/>
            <filter src_ip="145.105.189.34" dst_ip="190.21.219.243" src_port="3907" dst_port="80"/>
        </slice>
        <from usec="0" sec="1284008748"/>
        <to usec="0" sec="1284008765"/>
    </anomaly>
    <anomaly type="suspicious" value="1.315990,1.413370,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="148.36.213.131" src_port="20129" dst_port="20129"/>
        </slice>
        <from usec="0" sec="1284008742"/>
        <to usec="0" sec="1284009245"/>
    </anomaly>
    <anomaly type="suspicious" value="1.315990,1.413370,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="167.190.200.24" dst_ip="48.96.65.163" src_port="51661" dst_port="80"/>
        </slice>
        <from usec="0" sec="1284008757"/>
        <to usec="0" sec="1284008795"/>
    </anomaly>
    <anomaly type="suspicious" value="1.315990,1.413370,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="198.45.129.176" dst_ip="169.160.163.168" src_port="55809" dst_port="80"/>
        </slice>
        <from usec="0" sec="1284008783"/>
        <to usec="0" sec="1284008793"/>
    </anomaly>
    <anomaly type="suspicious" value="1.234610,1.342210,999,1 1 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="199.56.52.118" dst_ip="209.78.133.214" src_port="53817" dst_port="873"/>
            <filter src_ip="199.56.52.118" dst_ip="209.78.133.214" src_port="46373" dst_port="873"/>
            <filter src_ip="199.56.52.118" dst_ip="209.78.133.214" src_port="37358" dst_port="873"/>
            <filter src_ip="199.56.48.191" dst_ip="209.78.133.214" src_port="53454" dst_port="873"/>
            <filter src_ip="199.56.48.191" dst_ip="209.78.133.214" src_port="50010" dst_port="873"/>
        </slice>
        <from usec="0" sec="1284008401"/>
        <to usec="0" sec="1284008869"/>
    </anomaly>
    <anomaly type="suspicious" value="1.315990,1.413370,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="145.105.141.68" dst_port="80"/>
            <filter src_ip="145.105.141.68" dst_ip="150.18.139.21" dst_port="443"/>
        </slice>
        <from usec="0" sec="1284008748"/>
        <to usec="0" sec="1284008775"/>
    </anomaly>
    <anomaly type="suspicious" value="1.315990,1.413370,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="167.190.19.224" dst_ip="141.50.128.219" dst_port="80"/>
            <filter src_ip="167.190.19.224" dst_ip="141.50.128.221" dst_port="80"/>
        </slice>
        <from usec="0" sec="1284008787"/>
        <to usec="0" sec="1284008790"/>
    </anomaly>
    <anomaly type="suspicious" value="1.315990,1.413370,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICterp">
        <slice>
            <filter src_ip="198.32.119.66" dst_ip="65.90.40.95"/>
        </slice>
        <from usec="0" sec="1284008845"/>
        <to usec="0" sec="1284008846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.315990,1.413370,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.77.28.145" dst_port="23"/>
        </slice>
        <from usec="0" sec="1284008447"/>
        <to usec="0" sec="1284008453"/>
    </anomaly>
    <anomaly type="suspicious" value="1.315990,1.413370,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="216.24.153.96" dst_port="139"/>
        </slice>
        <from usec="0" sec="1284009236"/>
        <to usec="0" sec="1284009276"/>
    </anomaly>
    <anomaly type="suspicious" value="1.315990,1.413370,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="60.132.116.99" dst_port="139"/>
        </slice>
        <from usec="0" sec="1284009129"/>
        <to usec="0" sec="1284009289"/>
    </anomaly>
    <anomaly type="suspicious" value="1.315990,1.413370,011,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="221.127.147.29" src_port="3389" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1284009062"/>
        <to usec="0" sec="1284009067"/>
    </anomaly>
    <anomaly type="suspicious" value="1.315990,1.413370,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="60.132.116.99"/>
        </slice>
        <from usec="0" sec="1284009129"/>
        <to usec="0" sec="1284009289"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137120,1.351110,999,0 0 0 1 1 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="198.211.231.113" src_port="53"/>
        </slice>
        <from usec="0" sec="1284008401"/>
        <to usec="0" sec="1284009122"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137120,1.351110,503,0 0 0 1 1 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.56.52.99" dst_port="80"/>
        </slice>
        <from usec="0" sec="1284008401"/>
        <to usec="0" sec="1284008599"/>
    </anomaly>
    <anomaly type="suspicious" value="1.009140,1.204000,503,1 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="167.190.180.98" src_port="80"/>
        </slice>
        <from usec="0" sec="1284008787"/>
        <to usec="0" sec="1284009276"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="203.54.47.9" dst_ip="222.203.117.216" src_port="53"/>
        </slice>
        <from usec="0" sec="1284008401"/>
        <to usec="0" sec="1284008447"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="145.105.151.76" src_port="53"/>
            <filter dst_ip="145.105.151.76" dst_port="53"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter dst_ip="18.141.3.168"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="198.32.86.76" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1284008401"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="167.190.238.72"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="199.56.56.118"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="198.45.152.171"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="208.6.125.25" dst_ip="148.142.74.126" dst_port="53"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="198.45.152.70" dst_port="53"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="164.12.216.245" src_port="53"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.196630,1.436630,503,1 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="167.190.180.100" dst_port="80"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008797"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="167.190.180.98" dst_port="80"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="199.56.60.112" src_port="53"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="148.36.54.91" dst_port="53"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="167.190.133.76" src_port="53"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="199.56.60.102" dst_port="53"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,503,0 0 0 0 0 0 1 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="148.48.129.150" src_port="80"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.56.52.97" dst_port="80"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="198.45.60.7" dst_port="53"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,503,0 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="223.17.82.131" dst_port="80"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,010,0 0 0 0 0 0 1 0 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="192.168.65.129" dst_port="80"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,010,0 0 0 0 0 0 1 0 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="145.105.93.39" dst_port="443"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="148.36.194.139" dst_port="53"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="137.89.28.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008672"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="199.56.60.112" src_port="53"/>
            <filter dst_ip="199.56.60.112" dst_port="53"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008987"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="199.56.57.65" src_port="53"/>
            <filter dst_ip="199.56.57.65" dst_port="53"/>
        </slice>
        <from usec="0" sec="1284008491"/>
        <to usec="0" sec="1284008987"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="148.36.213.160"/>
        </slice>
        <from usec="0" sec="1284008671"/>
        <to usec="0" sec="1284008717"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="164.12.148.17"/>
        </slice>
        <from usec="0" sec="1284008806"/>
        <to usec="0" sec="1284008852"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001120,1.418670,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="164.12.216.245"/>
        </slice>
        <from usec="0" sec="1284008941"/>
        <to usec="0" sec="1284008987"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="145.105.146.178"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,999,0 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="167.190.225.156"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.052740,1.178770,999,0 0 0 1 1 0 0 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="148.36.194.139" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.052740,1.178770,503,0 0 0 1 1 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="199.56.52.99" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="209.27.181.188"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="210.34.165.51"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="212.216.105.251"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="88.234.58.133"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="33.32.192.38"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,503,0 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="145.105.76.10" src_port="53"/>
            <filter src_ip="149.119.129.25" dst_ip="145.105.76.10" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="209.160.67.183" dst_ip="167.190.74.136" dst_port="80"/>
            <filter src_ip="33.73.181.237" dst_ip="167.190.74.136" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="167.190.151.221"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="169.162.102.170"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,503,0 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.56.40.59" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="209.160.67.175"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="211.37.223.82"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="216.24.159.239"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="88.234.58.133"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="131.60.236.42" dst_ip="33.73.181.42" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="42.241.80.109"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,504,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="40.225.136.135"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="63.16.80.41"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.904141,1.255640,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="56.164.204.117"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
