<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="3.202370,2.430000,999,1 1 1 1 1 1 1 1 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="196.79.49.113" src_port="58584"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.065370,1.706450,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="196.79.229.114" dst_ip="217.171.65.82" src_port="80"/>
        </slice>
        <from usec="0" sec="1286687114"/>
        <to usec="0" sec="1286687214"/>
    </anomaly>
    <anomaly type="anomalous" value="1.540130,1.479290,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="8.254.126.180" dst_ip="182.222.63.196" src_port="62408" dst_port="64505"/>
            <filter src_ip="8.254.126.180" dst_ip="182.222.63.196" src_port="58256" dst_port="56485"/>
            <filter src_ip="8.254.126.180" dst_ip="182.222.63.196" src_port="52532" dst_port="65337"/>
            <filter src_ip="8.254.126.180" dst_ip="182.222.63.196" src_port="50919" dst_port="62906"/>
        </slice>
        <from usec="0" sec="1286687334"/>
        <to usec="0" sec="1286687377"/>
    </anomaly>
    <anomaly type="anomalous" value="2.325960,1.704250,010,1 1 1 0 0 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="67.107.104.104" src_port="6000" dst_port="9415"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.325960,1.704250,010,1 1 1 0 0 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="69.146.151.51" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.065370,1.706450,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="42.232.35.165" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1286687311"/>
        <to usec="0" sec="1286687313"/>
    </anomaly>
    <anomaly type="anomalous" value="2.771030,1.932050,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="69.154.26.102" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.771030,1.932050,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="209.252.110.113" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.406380,1.240850,503,1 0 0 1 1 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="196.79.229.114" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.082200,1.567380,503,1 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="196.79.232.64" dst_port="53"/>
            <filter dst_ip="196.79.229.74" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.715220,1.925300,999,1 1 1 1 1 1 1 0 0 1 1 0,ipv46tun">
        <slice>
            <filter src_ip="203.251.184.160"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.981990,2.254510,010,1 1 1 1 0 0 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="221.235.64.135" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.612520,1.956300,010,1 1 1 1 1 1 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="216.92.116.254" src_port="12200" dst_port="27977"/>
            <filter src_ip="216.92.116.254" src_port="12200" dst_port="8085"/>
        </slice>
        <from usec="0" sec="1286686804"/>
        <to usec="0" sec="1286687537"/>
    </anomaly>
    <anomaly type="anomalous" value="1.901130,1.544480,503,0 0 0 1 1 1 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="153.6.238.104" dst_ip="1.83.188.98" src_port="80"/>
            <filter src_ip="141.117.33.112" dst_ip="1.83.188.98" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.571620,1.546910,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="196.79.238.73" dst_ip="8.42.192.30" src_port="80" dst_port="57716"/>
        </slice>
        <from usec="0" sec="1286687230"/>
        <to usec="0" sec="1286687235"/>
    </anomaly>
    <anomaly type="anomalous" value="1.901130,1.544480,503,0 0 0 1 1 1 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="182.222.210.198" dst_ip="210.147.78.248" src_port="80"/>
            <filter src_ip="141.117.209.211" dst_ip="210.147.78.248" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.361550,1.257480,503,0 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="196.79.229.74" src_port="80"/>
            <filter src_ip="196.79.229.75" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.104840,1.937360,053,0 0 0 1 1 0 1 1 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="182.222.210.128" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.823050,1.954380,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="218.216.95.140" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.437710,1.276070,999,1 0 0 0 0 0 1 0 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="196.79.225.141" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.792540,2.275740,010,1 1 1 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.180.179.95" src_port="12200" dst_port="8088"/>
            <filter src_ip="222.180.179.95" src_port="12200" dst_port="8008"/>
            <filter src_ip="222.180.179.95" src_port="12200" dst_port="8000"/>
            <filter src_ip="222.180.179.95" src_port="12200" dst_port="8090"/>
        </slice>
        <from usec="0" sec="1286686845"/>
        <to usec="0" sec="1286686891"/>
    </anomaly>
    <anomaly type="anomalous" value="2.293080,1.928700,999,1 0 0 1 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="196.79.228.64"/>
            <filter dst_ip="196.79.234.17" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.204680,1.933340,053,1 0 0 1 1 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="182.222.210.128" dst_port="80"/>
            <filter src_ip="196.79.228.74" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.901130,1.544480,503,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="136.222.184.9" dst_ip="3.193.216.234" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.361550,1.257480,503,0 0 0 1 1 0 0 0 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="182.222.210.255" dst_ip="71.46.226.19" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.332680,1.241590,503,1 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="193.94.111.103" dst_ip="141.102.76.39" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.361550,1.257480,503,0 0 0 1 1 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="196.79.236.86" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.332680,1.241590,503,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="211.44.35.83" src_port="80"/>
            <filter src_ip="196.79.238.73" dst_ip="0.106.202.82" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.332680,1.241590,503,1 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="136.222.46.232" src_port="80"/>
            <filter src_ip="136.222.46.232" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.604700,1.285510,503,1 0 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="196.79.228.64"/>
            <filter src_ip="196.79.234.17" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.901130,1.544480,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="137.70.34.246" src_port="80"/>
            <filter dst_ip="210.147.78.83" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.332680,1.241590,503,1 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="71.46.226.19" dst_ip="182.222.210.255" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.420090,1.240820,503,1 0 0 1 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="196.79.236.86" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.332680,1.241590,504,1 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="136.222.88.190" dst_ip="193.182.117.82" src_port="48883" dst_port="443"/>
            <filter src_ip="141.102.184.83" dst_ip="193.182.117.82" src_port="1525" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.901130,1.544480,501,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="153.6.238.104" dst_ip="1.83.188.204" src_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.933990,1.243840,999,1 0 0 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="196.79.237.67" dst_port="53"/>
        </slice>
        <from usec="0" sec="1286686800"/>
        <to usec="0" sec="1286687060"/>
    </anomaly>
    <anomaly type="suspicious" value="0.933990,1.243840,999,1 0 0 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="182.222.210.129" src_port="53"/>
        </slice>
        <from usec="0" sec="1286686801"/>
        <to usec="0" sec="1286687448"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842313,1.260470,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="141.117.192.127" dst_ip="1.83.188.117" src_port="80"/>
        </slice>
        <from usec="0" sec="1286686800"/>
        <to usec="0" sec="1286686997"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842313,1.260470,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="136.222.230.124" dst_ip="186.62.225.176" src_port="80" dst_port="46807"/>
            <filter src_ip="136.222.230.124" dst_ip="186.62.225.176" src_port="80" dst_port="42990"/>
            <filter src_ip="136.222.84.208" dst_ip="186.62.225.176" src_port="80" dst_port="54127"/>
            <filter src_ip="136.222.84.208" dst_ip="186.62.225.176" src_port="80" dst_port="41086"/>
        </slice>
        <from usec="0" sec="1286686859"/>
        <to usec="0" sec="1286686899"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842313,1.260470,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="182.222.63.231" dst_ip="85.39.145.13" src_port="5041" dst_port="56868"/>
        </slice>
        <from usec="0" sec="1286686985"/>
        <to usec="0" sec="1286686998"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842313,1.260470,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="196.79.229.114" dst_ip="185.218.155.60" src_port="80"/>
        </slice>
        <from usec="0" sec="1286686940"/>
        <to usec="0" sec="1286687075"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842313,1.260470,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="3.2.40.173" dst_ip="182.222.229.210" src_port="80"/>
            <filter src_ip="3.2.40.173" dst_ip="182.222.229.210" src_port="443"/>
        </slice>
        <from usec="0" sec="1286686974"/>
        <to usec="0" sec="1286687084"/>
    </anomaly>
    <anomaly type="suspicious" value="0.871682,1.295170,503,0 0 0 0 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="138.60.173.171" dst_port="80"/>
            <filter dst_ip="138.60.173.171" dst_port="443"/>
        </slice>
        <from usec="0" sec="1286686806"/>
        <to usec="0" sec="1286687176"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842313,1.260470,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="197.182.152.117" dst_ip="4.23.164.22" src_port="25" dst_port="52247"/>
        </slice>
        <from usec="0" sec="1286686850"/>
        <to usec="0" sec="1286687160"/>
    </anomaly>
    <anomaly type="suspicious" value="1.067600,1.254280,999,1 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="182.222.63.196" dst_ip="8.254.126.180" src_port="65337" dst_port="52532"/>
            <filter src_ip="182.222.63.196" dst_ip="8.254.126.180" src_port="64505" dst_port="62408"/>
            <filter src_ip="182.222.63.196" dst_ip="8.254.126.180" src_port="62906" dst_port="50919"/>
            <filter src_ip="182.222.63.196" dst_ip="8.254.126.180" src_port="56485" dst_port="58256"/>
            <filter src_ip="182.222.63.196" dst_ip="8.254.126.180"/>
        </slice>
        <from usec="0" sec="1286686800"/>
        <to usec="0" sec="1286687268"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842313,1.260470,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="196.79.229.114" dst_ip="196.136.12.20" src_port="80"/>
        </slice>
        <from usec="0" sec="1286686800"/>
        <to usec="0" sec="1286687116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842313,1.260470,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="141.102.193.97" dst_ip="1.83.188.90" src_port="80"/>
            <filter src_ip="141.117.14.84" dst_ip="1.83.188.90" src_port="80"/>
        </slice>
        <from usec="0" sec="1286686815"/>
        <to usec="0" sec="1286687439"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842313,1.260470,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="182.222.60.11" dst_ip="186.50.233.90" src_port="8376" dst_port="33073"/>
        </slice>
        <from usec="0" sec="1286687023"/>
        <to usec="0" sec="1286687256"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842313,1.260470,503,0 0 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="205.138.200.177" dst_port="80"/>
        </slice>
        <from usec="0" sec="1286686817"/>
        <to usec="0" sec="1286687332"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842313,1.260470,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="197.89.249.104" src_port="53"/>
        </slice>
        <from usec="0" sec="1286686800"/>
        <to usec="0" sec="1286687538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842313,1.260470,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="211.44.35.83" dst_ip="182.222.238.130" dst_port="80"/>
            <filter src_ip="221.47.40.245" dst_ip="182.222.238.130" dst_port="80"/>
        </slice>
        <from usec="0" sec="1286686818"/>
        <to usec="0" sec="1286687628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842313,1.260470,503,0 0 0 1 1 0 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="197.80.104.108" dst_ip="3.154.195.212" dst_port="80"/>
        </slice>
        <from usec="0" sec="1286686987"/>
        <to usec="0" sec="1286687628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842313,1.260470,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="141.102.193.201" dst_ip="1.83.188.33" src_port="53" dst_port="34325"/>
            <filter src_ip="196.79.230.133" dst_ip="1.83.188.33" src_port="80" dst_port="47095"/>
            <filter src_ip="141.117.243.236" dst_ip="1.83.188.33" src_port="53" dst_port="33788"/>
        </slice>
        <from usec="0" sec="1286687389"/>
        <to usec="0" sec="1286687512"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842313,1.260470,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="141.102.193.207" dst_ip="222.144.93.179" src_port="25" dst_port="54786"/>
        </slice>
        <from usec="0" sec="1286687463"/>
        <to usec="0" sec="1286687494"/>
    </anomaly>
    <anomaly type="suspicious" value="1.919270,1.934670,053,0 0 0 1 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="196.79.228.74" src_port="80"/>
        </slice>
        <from usec="0" sec="1286686800"/>
        <to usec="0" sec="1286687268"/>
    </anomaly>
    <anomaly type="suspicious" value="0.960560,1.279000,999,1 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="196.79.235.50" dst_port="53"/>
        </slice>
        <from usec="0" sec="1286686800"/>
        <to usec="0" sec="1286687195"/>
    </anomaly>
    <anomaly type="suspicious" value="1.121010,1.211800,503,0 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="136.222.42.64" src_port="80"/>
            <filter dst_ip="40.131.110.65" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.835621,1.164290,011,0 0 0 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="136.222.145.235" src_port="41972"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138170,1.211770,503,0 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="196.79.225.141" src_port="53"/>
            <filter src_ip="196.79.225.141" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.160070,1.247830,503,0 0 0 0 0 0 0 0 0 1 1 1,point_to_point">
        <slice>
            <filter src_ip="40.131.108.173" dst_ip="182.222.63.200" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.835621,1.164290,503,0 0 0 1 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="9.196.220.250" dst_ip="182.222.72.58" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.019590,1.237370,020,0 0 0 0 0 0 1 0 0 1 1 0,DDoSIC">
        <slice>
            <filter dst_ip="196.79.233.18"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.160070,1.247830,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="136.222.184.50" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.905572,1.202740,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="182.222.62.13" dst_ip="8.9.156.49" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865217,1.201780,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="136.222.111.179" dst_ip="1.74.44.138" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865217,1.201780,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="153.6.239.112" dst_ip="1.83.186.191" src_port="80" dst_port="65435"/>
            <filter src_ip="153.6.239.112" dst_ip="1.83.186.191" src_port="80" dst_port="54136"/>
            <filter src_ip="153.6.239.112" dst_ip="1.83.186.191" src_port="80" dst_port="34813"/>
            <filter src_ip="153.6.239.112" dst_ip="210.147.78.84" src_port="80" dst_port="56850"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865217,1.201780,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="182.222.62.13" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865217,1.201780,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="136.222.59.215" dst_ip="130.45.197.218" dst_port="80"/>
            <filter src_ip="136.222.210.189" dst_ip="130.45.197.218" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.212370,1.231070,503,1 0 0 0 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="182.222.210.139"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.019590,1.237370,503,0 0 0 0 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="182.222.210.131" dst_port="80"/>
            <filter dst_ip="182.222.210.131" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865217,1.201780,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="182.222.62.172" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865217,1.201780,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="182.222.63.231" src_port="80"/>
            <filter dst_ip="182.222.63.231" src_port="5041" dst_port="5041"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865217,1.201780,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="136.222.88.190" dst_ip="168.120.47.96" src_port="57622" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.160070,1.247830,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="141.102.76.39" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865217,1.201780,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="136.222.88.190" dst_ip="193.182.117.98" src_port="32890" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.160070,1.247830,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="141.117.192.78" dst_ip="210.147.78.246" src_port="80"/>
            <filter src_ip="141.117.33.101" dst_ip="210.147.78.246" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865217,1.201780,503,0 0 0 0 0 0 0 0 0 1 1 0,point_to_point">
        <slice>
            <filter src_ip="153.6.42.240" dst_ip="210.147.78.91" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865217,1.201780,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="210.147.78.85" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138170,1.211770,503,0 0 0 1 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="141.117.145.4" dst_ip="210.147.78.57" src_port="80"/>
            <filter src_ip="136.222.10.235" dst_ip="210.147.78.57" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.160070,1.247830,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="136.222.93.16" dst_ip="208.143.201.160" src_port="49495" dst_port="80"/>
            <filter src_ip="136.222.93.16" dst_ip="208.143.201.160" src_port="49494" dst_port="80"/>
            <filter src_ip="136.222.93.16" dst_ip="208.143.201.160" src_port="49461" dst_port="80"/>
            <filter src_ip="136.222.93.16" dst_ip="208.143.201.160" src_port="49459" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.160070,1.247830,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="136.222.36.50" dst_ip="220.5.166.29" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.160070,1.247830,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="182.222.210.252" dst_ip="68.51.104.32" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279350,1.282140,020,0 0 0 0 0 0 1 0 0 1 1 1,ntscTCPICdurp">
        <slice>
            <filter dst_ip="69.154.26.102"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865217,1.201780,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="136.222.171.5" dst_ip="3.203.112.107" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.160070,1.247830,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="141.102.193.132" dst_ip="0.106.210.201" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865217,1.201780,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="141.117.192.9" dst_ip="8.42.192.18" src_port="80" dst_port="44719"/>
            <filter src_ip="141.117.160.30" dst_ip="8.42.192.18" src_port="80" dst_port="43477"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865016,1.260440,504,0 0 0 1 0 0 0 0 0 0 0 1,mptp">
        <slice>
            <filter dst_ip="138.60.173.208" dst_port="80"/>
            <filter dst_ip="138.60.173.208" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
