<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.839430,1.545770,503,1 1 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="166.26.115.9" src_port="80"/>
        </slice>
        <from usec="0" sec="1289451600"/>
        <to usec="0" sec="1289452158"/>
    </anomaly>
    <anomaly type="anomalous" value="2.816450,1.959180,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="80.79.89.228" src_port="6000" dst_port="4899"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.033830,1.795480,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="6.33.55.150" dst_port="25"/>
        </slice>
        <from usec="0" sec="1289451935"/>
        <to usec="0" sec="1289451947"/>
    </anomaly>
    <anomaly type="anomalous" value="2.540450,1.844320,502,1 1 1 1 1 1 1 1 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="200.244.253.242" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.689390,1.344210,503,0 0 0 1 1 1 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="133.4.132.39" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.927940,1.471060,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="128.7.108.18" dst_ip="42.146.67.196" src_port="80"/>
            <filter src_ip="128.7.108.18" dst_ip="203.47.62.130" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.573860,1.335450,503,0 0 0 1 1 1 0 0 0 1 0 0,salphfl">
        <slice>
            <filter src_ip="210.33.132.20" dst_ip="42.146.67.82" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.527200,1.375370,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="128.7.207.164" dst_ip="32.34.71.118" src_port="80" dst_port="60885"/>
            <filter src_ip="128.7.207.164" dst_ip="32.34.71.101" src_port="80" dst_port="64912"/>
            <filter src_ip="128.7.207.164" dst_ip="32.34.71.217" src_port="21" dst_port="37631"/>
            <filter src_ip="128.7.207.164" dst_ip="42.146.70.164" src_port="80" dst_port="53848"/>
        </slice>
        <from usec="0" sec="1289451679"/>
        <to usec="0" sec="1289451781"/>
    </anomaly>
    <anomaly type="anomalous" value="1.927940,1.471060,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="128.7.73.64" dst_ip="203.47.62.138" src_port="80" dst_port="34598"/>
            <filter src_ip="128.7.73.64" dst_ip="42.146.69.73" src_port="80" dst_port="59223"/>
            <filter src_ip="128.7.73.64" dst_ip="42.146.69.22" src_port="80" dst_port="65253"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.527200,1.375370,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="80.152.49.136" dst_ip="133.4.182.41" src_port="80"/>
            <filter src_ip="80.152.49.137" dst_ip="133.4.182.41" src_port="80"/>
        </slice>
        <from usec="0" sec="1289451823"/>
        <to usec="0" sec="1289451888"/>
    </anomaly>
    <anomaly type="anomalous" value="1.527200,1.375370,999,0 0 0 1 1 1 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.47.52.211" src_port="993"/>
            <filter src_ip="203.47.52.211" src_port="995"/>
        </slice>
        <from usec="0" sec="1289451600"/>
        <to usec="0" sec="1289452427"/>
    </anomaly>
    <anomaly type="anomalous" value="1.527200,1.375370,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="158.196.108.14" dst_ip="203.47.62.105" src_port="80" dst_port="61780"/>
            <filter src_ip="158.196.108.14" dst_ip="203.47.62.105" src_port="80" dst_port="58231"/>
            <filter src_ip="158.196.108.14" dst_ip="42.146.68.43" src_port="80" dst_port="57383"/>
        </slice>
        <from usec="0" sec="1289451923"/>
        <to usec="0" sec="1289451975"/>
    </anomaly>
    <anomaly type="anomalous" value="1.927940,1.471060,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="210.42.201.210" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.527200,1.375370,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="166.26.25.37" dst_ip="203.211.29.238" src_port="51718" dst_port="80"/>
        </slice>
        <from usec="0" sec="1289452165"/>
        <to usec="0" sec="1289452338"/>
    </anomaly>
    <anomaly type="anomalous" value="1.527200,1.375370,503,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="128.7.6.138" dst_ip="42.146.67.134" src_port="80"/>
            <filter src_ip="158.196.102.8" dst_ip="198.32.194.122" dst_port="53"/>
        </slice>
        <from usec="0" sec="1289451605"/>
        <to usec="0" sec="1289452403"/>
    </anomaly>
    <anomaly type="anomalous" value="1.914240,1.445230,503,0 0 0 1 1 1 1 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="6.116.45.18" dst_ip="128.1.183.247" src_port="80"/>
            <filter src_ip="6.116.45.19" dst_ip="128.1.183.247" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.586980,1.859520,999,1 1 1 1 1 1 1 1 1 1 0 0,ptmp">
        <slice>
            <filter src_ip="211.185.9.216" src_port="58584"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.407850,1.257450,503,1 0 0 1 1 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="211.185.145.69" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.401520,1.341490,503,1 0 0 0 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="211.185.155.217" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.868060,1.458300,503,1 1 0 1 0 0 1 1 1 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="210.42.229.24" dst_port="53"/>
            <filter src_ip="210.42.229.24" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.785580,1.355230,999,1 0 0 1 1 1 1 1 1 1 0 0,ipv46tun">
        <slice>
            <filter src_ip="218.209.91.109"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.011790,1.461090,999,0 0 0 1 1 1 1 1 1 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="211.185.156.74" src_port="53"/>
            <filter dst_ip="211.185.156.74" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.345280,1.767240,999,1 1 1 1 0 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter src_ip="211.185.144.18"/>
            <filter src_ip="211.185.144.30" src_port="52287"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.147430,1.756780,503,1 1 1 0 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="166.26.179.88"/>
            <filter src_ip="211.185.144.19" src_port="80"/>
            <filter src_ip="210.33.133.135" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.104330,1.489040,503,1 0 0 1 1 1 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="211.185.155.217" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.349700,1.869780,503,1 1 1 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="133.4.117.120" src_port="80"/>
            <filter dst_ip="133.4.144.247" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.496530,1.311610,503,0 0 0 1 0 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="211.185.151.252" dst_port="80"/>
            <filter dst_ip="211.185.151.252" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.816450,1.959180,999,1 1 1 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="211.185.154.94" dst_port="53"/>
            <filter src_ip="211.185.156.74" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.927940,1.471060,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="210.33.109.149" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.402250,1.327870,503,0 0 0 0 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="211.185.145.108" src_port="80"/>
            <filter src_ip="211.185.145.109" src_port="80"/>
            <filter src_ip="211.185.145.111" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.689390,1.344210,503,0 0 0 1 1 1 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="203.47.62.114" src_port="80"/>
            <filter src_ip="128.7.172.178" dst_ip="42.146.68.81" src_port="80"/>
            <filter src_ip="128.7.172.178" dst_ip="198.32.26.56" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.233490,1.763450,503,1 1 1 0 0 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter src_ip="210.42.201.210" dst_port="80"/>
            <filter dst_ip="42.146.85.146" dst_port="80"/>
            <filter dst_ip="42.146.85.153" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.458010,1.492390,010,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="211.233.71.237" src_port="22"/>
        </slice>
        <from usec="0" sec="1289451629"/>
        <to usec="0" sec="1289451776"/>
    </anomaly>
    <anomaly type="suspicious" value="0.873617,1.238350,999,0 0 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="128.19.149.72"/>
        </slice>
        <from usec="0" sec="1289451600"/>
        <to usec="0" sec="1289451708"/>
    </anomaly>
    <anomaly type="suspicious" value="0.873617,1.238350,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="128.165.168.75"/>
        </slice>
        <from usec="0" sec="1289451607"/>
        <to usec="0" sec="1289451888"/>
    </anomaly>
    <anomaly type="suspicious" value="0.873617,1.238350,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="128.19.230.11"/>
        </slice>
        <from usec="0" sec="1289451601"/>
        <to usec="0" sec="1289452150"/>
    </anomaly>
    <anomaly type="suspicious" value="0.873617,1.238350,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="211.185.145.69"/>
        </slice>
        <from usec="0" sec="1289451600"/>
        <to usec="0" sec="1289452428"/>
    </anomaly>
    <anomaly type="suspicious" value="0.873617,1.238350,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="81.147.200.208"/>
        </slice>
        <from usec="0" sec="1289451600"/>
        <to usec="0" sec="1289452425"/>
    </anomaly>
    <anomaly type="suspicious" value="0.999837,1.157470,503,0 0 0 1 0 0 1 1 0 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="166.26.179.18" dst_ip="83.50.118.88" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.852288,1.175860,020,0 0 0 0 0 0 1 1 1 1 0 0,ttl_error">
        <slice>
            <filter src_ip="128.158.194.254"/>
            <filter src_ip="128.158.194.252"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.052300,1.210420,503,1 0 0 0 0 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="166.26.179.81" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.848779,1.166200,999,0 0 0 0 0 0 1 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="210.33.154.53" src_port="16001"/>
            <filter src_ip="210.33.154.53" src_port="8892"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.218330,1.220080,503,1 0 0 0 0 0 1 1 1 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="210.33.110.38" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879244,1.198070,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="128.7.96.65" dst_ip="42.146.68.226" src_port="53" dst_port="60393"/>
            <filter src_ip="128.7.96.65" dst_ip="42.146.68.226" src_port="53" dst_port="51203"/>
            <filter src_ip="158.196.194.42" dst_ip="42.146.68.226" src_port="53" dst_port="34803"/>
            <filter src_ip="158.196.18.48" dst_ip="42.146.68.226" src_port="80" dst_port="44846"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879244,1.198070,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="133.4.236.118" dst_port="80"/>
            <filter src_ip="133.4.236.118" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879244,1.198070,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="128.165.210.147" dst_ip="67.72.30.92" dst_port="443"/>
            <filter src_ip="128.165.210.147" dst_ip="67.72.30.92" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879244,1.198070,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="171.137.204.98" dst_ip="166.26.115.65" src_port="80" dst_port="8600"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879244,1.198070,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="211.185.145.64" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.049460,1.201040,503,1 0 0 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="210.33.110.38" src_port="80"/>
            <filter dst_ip="210.33.108.78" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879244,1.198070,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="202.52.209.56" dst_ip="133.4.132.38" src_port="80" dst_port="43988"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.929977,1.161820,503,0 0 0 0 0 0 1 1 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="210.42.229.24" src_port="53"/>
            <filter dst_ip="210.42.229.24" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879244,1.198070,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="42.146.85.153" dst_ip="166.26.204.2" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.929977,1.161820,504,0 0 0 0 0 0 1 1 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="42.146.85.162" src_port="443"/>
            <filter src_ip="42.146.85.168" dst_ip="166.26.0.92" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879244,1.198070,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="42.146.85.129" dst_ip="166.26.40.194" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879244,1.198070,504,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="128.19.148.56" dst_ip="171.128.43.196" src_port="56706" dst_port="443"/>
            <filter src_ip="128.19.148.56" dst_ip="171.128.43.196" src_port="56705" dst_port="443"/>
            <filter src_ip="133.4.140.21" dst_ip="171.128.43.196" src_port="10081" dst_port="443"/>
            <filter src_ip="133.4.132.39" dst_ip="171.128.43.196" src_port="2316" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279060,1.338830,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="43.65.200.189" src_port="80"/>
            <filter dst_ip="210.33.141.89" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279060,1.338830,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="210.33.104.76" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879244,1.198070,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="133.4.144.247" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.258310,1.310400,999,0 0 0 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.47.52.211"/>
            <filter dst_ip="42.146.85.162" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279060,1.338830,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="158.196.119.45" dst_ip="203.47.62.113"/>
            <filter src_ip="158.196.119.45" src_port="53"/>
            <filter dst_ip="203.47.62.113" src_port="80"/>
            <filter src_ip="158.196.119.45" dst_ip="42.146.68.18" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279060,1.338830,503,0 0 0 0 0 0 0 0 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="211.185.151.253" dst_ip="83.50.118.88" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279060,1.338830,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="128.19.106.47" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279060,1.338830,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="166.26.194.72" dst_ip="42.146.68.57" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879244,1.198070,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="210.33.142.206" dst_ip="43.65.200.189" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
