<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.628520,1.368830,503,1 1 1 1 0 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="173.46.150.218"/>
            <filter dst_ip="213.240.196.56"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.262180,1.257400,503,1 1 1 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="131.19.118.73" dst_port="80"/>
            <filter src_ip="131.19.118.32" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.990140,1.479200,503,1 1 0 1 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="213.240.197.20" dst_port="80"/>
            <filter dst_ip="213.240.197.23" dst_port="80"/>
            <filter dst_ip="213.240.197.21" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.138320,1.520820,503,1 1 1 1 0 0 1 1 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="173.46.18.77" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.810000,1.421860,503,1 1 1 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="173.46.18.77" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.632290,1.377240,503,1 1 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="212.68.150.190" dst_ip="206.188.220.133" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.392840,1.261030,503,1 1 0 0 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="213.240.193.144" dst_port="53"/>
            <filter dst_ip="213.240.193.144" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.819500,2.089080,503,1 1 1 1 1 1 1 1 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="213.240.193.144" dst_port="80"/>
            <filter dst_ip="213.240.193.144" dst_port="53"/>
            <filter dst_ip="213.240.201.171" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.810000,1.421860,503,1 1 1 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="212.68.150.190" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.488820,1.368620,503,1 1 0 1 1 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="173.46.150.165" dst_ip="67.115.52.163" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.703420,1.376730,503,1 1 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="213.240.197.20" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.819500,2.089080,010,1 1 1 1 1 1 1 1 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="54.100.166.7" src_port="11191" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.403210,1.379820,503,1 1 1 0 0 0 1 1 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="67.115.52.163" dst_ip="173.46.150.165" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130013"/>
        <to usec="0" sec="1292130901"/>
    </anomaly>
    <anomaly type="anomalous" value="1.681770,1.413500,503,1 1 1 1 1 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="212.73.120.223" dst_port="53"/>
            <filter src_ip="212.73.120.223" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.403210,1.379820,020,1 1 1 0 0 0 1 1 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="13.74.7.236"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130046"/>
    </anomaly>
    <anomaly type="anomalous" value="1.628520,1.368830,503,1 1 1 1 0 0 1 1 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="173.46.150.172" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.810000,1.421860,999,1 1 1 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="131.19.9.10" src_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.543550,1.423650,020,1 1 1 1 1 0 0 0 0 0 0 0,hostout">
        <slice>
            <filter src_ip="213.43.239.190"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130828"/>
    </anomaly>
    <anomaly type="anomalous" value="1.945710,1.493230,999,1 1 1 1 0 0 1 1 0 1 0 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.46.150.208" dst_port="6881"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.403210,1.379820,999,1 1 1 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="173.46.150.216"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130885"/>
    </anomaly>
    <anomaly type="anomalous" value="1.463690,1.290590,999,1 1 1 0 0 0 0 0 0 1 1 0,ipv46tun">
        <slice>
            <filter src_ip="218.136.178.92"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.703420,1.376730,503,1 1 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="131.19.118.74" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.722600,2.074320,999,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="170.168.168.6"/>
            <filter src_ip="213.240.201.171" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.703420,1.376730,503,1 1 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="213.240.196.56" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.543550,1.423650,999,1 1 1 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="173.46.150.208" src_port="6881"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130897"/>
    </anomaly>
    <anomaly type="anomalous" value="1.403210,1.379820,999,1 1 1 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="173.46.150.219" dst_port="53"/>
            <filter dst_ip="173.46.150.219"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130848"/>
    </anomaly>
    <anomaly type="anomalous" value="1.855140,1.522960,999,1 1 1 1 1 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.240.205.84" dst_port="53"/>
            <filter src_ip="213.240.200.12" dst_port="53"/>
            <filter src_ip="212.68.146.229" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130896"/>
    </anomaly>
    <anomaly type="anomalous" value="2.071260,1.598310,503,0 1 0 1 1 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="213.240.197.21" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.688080,1.430370,999,1 0 0 1 1 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="212.68.25.150"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.013850,2.172630,010,1 1 1 1 1 1 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="200.180.211.30" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.132200,1.536800,999,1 1 0 1 1 0 1 0 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="173.46.150.219" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.341770,3.614380,999,1 1 1 1 1 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="173.46.150.216"/>
            <filter src_ip="212.68.6.224"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.904080,2.115920,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="41.192.129.221" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.701850,2.030040,999,1 1 1 1 1 1 1 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="213.240.33.198" src_port="58584"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.722540,2.152850,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="192.156.51.133" src_port="80"/>
            <filter src_ip="133.0.152.0" dst_ip="9.53.95.37" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.722540,2.152850,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="133.0.156.211" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.694250,2.095830,503,1 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="133.0.35.110" dst_ip="9.53.33.85" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.929600,1.479670,503,1 1 0 0 0 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="212.68.6.224" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.403210,1.379820,503,1 1 1 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="173.46.150.169" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130002"/>
        <to usec="0" sec="1292130899"/>
    </anomaly>
    <anomaly type="anomalous" value="1.464190,1.364620,999,1 1 0 0 0 0 1 1 0 0 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="173.46.150.218"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.874580,3.498260,020,1 1 1 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="16.208.90.154"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130405"/>
    </anomaly>
    <anomaly type="anomalous" value="3.874580,3.498260,020,1 1 1 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="216.83.190.73"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130451"/>
    </anomaly>
    <anomaly type="anomalous" value="1.703320,1.492430,503,0 0 0 1 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="133.21.223.94" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.810000,1.421860,503,1 1 1 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="131.19.62.244" dst_ip="8.40.26.143" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.995830,1.549840,503,1 0 0 1 1 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="213.240.197.22" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.995830,1.549840,503,1 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="213.240.193.144" src_port="80"/>
            <filter src_ip="213.240.193.144" src_port="53"/>
            <filter src_ip="213.240.193.145" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.904080,2.115920,010,1 1 1 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="3.140.192.103" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.584550,1.409430,503,1 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="212.73.120.223" src_port="53"/>
            <filter dst_ip="212.73.120.223" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.632180,1.492910,503,0 0 0 0 0 0 0 0 0 1 1 1,point_to_point">
        <slice>
            <filter src_ip="130.11.157.146" dst_ip="8.49.206.163" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.474930,2.009090,999,1 0 0 1 1 1 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="155.31.77.11" dst_ip="192.156.51.41"/>
            <filter src_ip="155.31.77.11" src_port="21"/>
            <filter dst_ip="192.156.51.41" src_port="80"/>
            <filter dst_ip="192.156.51.41" src_port="21"/>
            <filter src_ip="155.31.77.11" dst_ip="8.49.202.118" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.584550,1.409430,503,1 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="173.46.150.164" dst_ip="192.156.51.7" src_port="80"/>
            <filter src_ip="155.31.68.50" dst_ip="192.156.51.7" src_port="80"/>
            <filter src_ip="131.19.73.112" dst_ip="192.156.51.7" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.694250,2.095830,503,1 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="173.46.186.87" src_port="80"/>
            <filter dst_ip="173.46.186.87" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.632180,1.492910,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="29.114.64.23" dst_ip="173.46.19.166" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.584550,1.409430,503,1 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="213.240.197.23" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.632180,1.492910,999,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="131.19.218.4" dst_ip="200.116.156.31" src_port="8080" dst_port="50696"/>
            <filter src_ip="131.19.218.4" dst_ip="200.116.156.31" src_port="22" dst_port="50610"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.632290,1.377240,503,1 1 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="213.240.193.144" src_port="53"/>
            <filter src_ip="213.240.193.144" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,999,1 1 1 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="131.19.49.66" dst_ip="9.56.119.10"/>
            <filter src_ip="131.19.49.66" src_port="25"/>
            <filter src_ip="131.19.49.66" dst_port="25"/>
            <filter src_ip="131.19.166.52" dst_ip="9.56.119.10" dst_port="25"/>
        </slice>
        <from usec="0" sec="1292130447"/>
        <to usec="0" sec="1292130495"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="173.46.18.8" dst_port="80"/>
            <filter dst_ip="212.72.158.210" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.097120,1.367010,503,1 0 0 0 0 0 1 1 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="131.19.168.196" dst_ip="9.56.95.153" dst_port="80"/>
            <filter src_ip="133.0.2.135" dst_ip="9.56.95.153" dst_port="80"/>
            <filter src_ip="131.19.168.5" dst_ip="9.56.95.153" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130763"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="131.19.217.240" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130213"/>
        <to usec="0" sec="1292130856"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148650,1.288680,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="16.208.90.154" dst_port="21"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130407"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="38.0.45.27" dst_ip="131.19.118.74" src_port="80" dst_port="51406"/>
            <filter src_ip="38.0.45.27" dst_ip="131.19.118.74" src_port="80" dst_port="50321"/>
            <filter src_ip="38.0.45.27" dst_ip="131.19.118.74" src_port="80" dst_port="47630"/>
            <filter src_ip="38.0.45.27" dst_ip="131.19.118.74" src_port="80" dst_port="41380"/>
            <filter src_ip="38.0.45.27" dst_ip="131.19.118.74" src_port="80" dst_port="40290"/>
        </slice>
        <from usec="0" sec="1292130116"/>
        <to usec="0" sec="1292130405"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="173.46.19.31" src_port="11546"/>
            <filter src_ip="173.46.19.31" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130901"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="131.19.218.177" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130603"/>
        <to usec="0" sec="1292130605"/>
    </anomaly>
    <anomaly type="suspicious" value="1.237190,1.241270,504,1 1 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="131.19.1.187"/>
            <filter src_ip="131.19.62.36" dst_port="80"/>
            <filter dst_ip="211.32.108.49" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148650,1.288680,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="160.161.102.218" dst_port="21"/>
        </slice>
        <from usec="0" sec="1292130001"/>
        <to usec="0" sec="1292130901"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="8.49.206.161" dst_ip="173.46.150.129" src_port="36926" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130075"/>
        <to usec="0" sec="1292130795"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="133.17.41.252" dst_ip="192.156.51.5" src_port="80" dst_port="51528"/>
        </slice>
        <from usec="0" sec="1292130052"/>
        <to usec="0" sec="1292130069"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="220.12.85.58" dst_ip="213.240.196.57" src_port="80" dst_port="44169"/>
        </slice>
        <from usec="0" sec="1292130261"/>
        <to usec="0" sec="1292130287"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="133.17.98.204" dst_ip="8.49.206.177" src_port="80" dst_port="35006"/>
        </slice>
        <from usec="0" sec="1292130575"/>
        <to usec="0" sec="1292130879"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="206.228.235.157" dst_ip="212.68.144.41" dst_port="80"/>
            <filter src_ip="206.228.235.145" dst_ip="212.68.144.41" dst_port="80"/>
            <filter src_ip="206.228.235.154" dst_ip="212.68.144.41" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130059"/>
        <to usec="0" sec="1292130104"/>
    </anomaly>
    <anomaly type="suspicious" value="1.071120,1.268800,999,1 1 1 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.0.35.48" src_port="25"/>
            <filter src_ip="133.0.35.48" dst_port="25"/>
        </slice>
        <from usec="0" sec="1292130005"/>
        <to usec="0" sec="1292130892"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164390,1.257960,011,1 1 1 0 0 0 0 0 0 1 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="3.140.192.103" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="9.53.50.95" dst_ip="213.240.205.19"/>
            <filter src_ip="9.53.50.95" dst_port="80"/>
            <filter src_ip="9.53.48.145" dst_ip="213.240.205.19" dst_port="80"/>
            <filter src_ip="9.53.95.230" dst_ip="213.240.205.19" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130013"/>
        <to usec="0" sec="1292130883"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148650,1.288680,999,1 1 1 0 0 0 1 0 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="218.136.178.94"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130451"/>
    </anomaly>
    <anomaly type="suspicious" value="1.330720,1.379100,503,1 1 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="195.137.193.28" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130024"/>
        <to usec="0" sec="1292130816"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,999,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="177.9.208.248" dst_ip="212.73.120.145" src_port="56556" dst_port="25"/>
            <filter src_ip="192.156.10.91" dst_ip="212.73.120.145" src_port="60334" dst_port="25"/>
        </slice>
        <from usec="0" sec="1292130762"/>
        <to usec="0" sec="1292130770"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990624,1.206730,999,1 1 0 1 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="212.68.6.224"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.165010,1.333800,999,1 1 0 0 0 0 1 1 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="23.242.214.132" dst_ip="133.141.131.81" dst_port="25"/>
        </slice>
        <from usec="0" sec="1292130531"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.996862,1.303670,503,1 0 1 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="64.249.89.250" dst_ip="131.19.247.101" src_port="80"/>
        </slice>
        <from usec="0" sec="1292130002"/>
        <to usec="0" sec="1292130325"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.0.143.43" dst_port="25"/>
        </slice>
        <from usec="0" sec="1292130163"/>
        <to usec="0" sec="1292130172"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="9.53.105.13" dst_ip="213.240.203.48" src_port="80" dst_port="1463"/>
            <filter src_ip="9.53.105.13" dst_ip="213.240.203.48" src_port="80" dst_port="1462"/>
        </slice>
        <from usec="0" sec="1292130074"/>
        <to usec="0" sec="1292130555"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148650,1.288680,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="216.83.190.73" dst_port="21"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130451"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="212.68.149.53" dst_ip="200.86.103.160" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130004"/>
        <to usec="0" sec="1292130882"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="131.19.148.173" dst_port="53"/>
            <filter src_ip="131.19.148.173" dst_ip="212.72.158.199" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130633"/>
        <to usec="0" sec="1292130677"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="131.19.145.67" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130217"/>
        <to usec="0" sec="1292130367"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="192.156.51.172" dst_ip="212.68.148.172" src_port="37254" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130269"/>
        <to usec="0" sec="1292130272"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148650,1.288680,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="160.161.142.61" dst_port="21"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164390,1.257960,503,1 1 1 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="9.53.48.152" dst_ip="213.240.202.165" dst_port="80"/>
            <filter src_ip="26.71.253.233" dst_ip="213.240.202.165" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148650,1.288680,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="181.129.83.41" dst_port="21"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130900"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="13.74.7.236" dst_port="21"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130004"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990624,1.206730,503,1 1 0 1 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="131.19.62.226" dst_ip="13.174.2.66" dst_port="80"/>
            <filter src_ip="131.19.62.226" dst_ip="4.94.160.213" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953946,1.269360,503,1 1 1 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="131.19.119.71" dst_port="80"/>
            <filter src_ip="212.68.8.245" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130001"/>
        <to usec="0" sec="1292130889"/>
    </anomaly>
    <anomaly type="suspicious" value="0.909814,1.243330,503,1 0 0 1 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="213.240.202.165" dst_ip="9.53.48.152" src_port="80"/>
            <filter src_ip="213.240.202.165" dst_ip="26.71.253.233" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.071120,1.268800,503,1 1 1 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="131.19.80.56" dst_port="80"/>
            <filter src_ip="131.19.145.154" dst_ip="212.72.158.199" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130896"/>
    </anomaly>
    <anomaly type="suspicious" value="1.292010,1.356850,503,1 1 0 1 0 0 0 0 0 0 0 1,ptmpHTTP">
        <slice>
            <filter src_ip="173.46.150.172" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238210,1.495090,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.330580,1.494620,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="173.46.116.147" dst_ip="67.115.53.104" dst_port="443"/>
            <filter src_ip="173.46.18.148" dst_ip="67.115.53.104" dst_port="443"/>
            <filter src_ip="173.46.18.160" dst_ip="67.115.53.104" dst_port="443"/>
        </slice>
        <from usec="0" sec="1292130018"/>
        <to usec="0" sec="1292130355"/>
    </anomaly>
    <anomaly type="suspicious" value="1.330580,1.494620,010,0 0 0 1 1 0 0 0 0 0 0 0,sptpDoSSYN">
        <slice>
            <filter src_ip="188.117.225.97" dst_ip="133.0.56.227" dst_port="11629"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130827"/>
    </anomaly>
    <anomaly type="suspicious" value="1.330580,1.494620,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="131.19.53.89" src_port="53"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130648"/>
    </anomaly>
    <anomaly type="suspicious" value="1.330580,1.494620,020,0 0 0 1 1 0 0 0 0 0 0 0,sptpDoSIC">
        <slice>
            <filter src_ip="212.68.6.229" dst_ip="158.112.229.199"/>
        </slice>
        <from usec="0" sec="1292130411"/>
        <to usec="0" sec="1292130610"/>
    </anomaly>
    <anomaly type="suspicious" value="1.330580,1.494620,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="9.53.50.95" src_port="53"/>
            <filter src_ip="213.240.205.19" dst_ip="9.53.50.95" src_port="80"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.262750,1.333280,999,1 1 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="174.41.119.216" src_port="53"/>
            <filter dst_ip="174.41.119.216" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130894"/>
    </anomaly>
    <anomaly type="suspicious" value="1.262750,1.333280,999,1 1 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="174.41.119.217" src_port="53"/>
            <filter dst_ip="174.41.119.217" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130894"/>
    </anomaly>
    <anomaly type="suspicious" value="1.165010,1.333800,999,1 1 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="212.73.83.22" src_port="53"/>
            <filter dst_ip="212.73.83.22" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130892"/>
    </anomaly>
    <anomaly type="suspicious" value="1.097120,1.367010,010,1 0 0 0 0 0 1 1 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="213.240.197.37" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.165010,1.333800,999,1 1 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="213.240.205.84" src_port="53"/>
            <filter dst_ip="213.240.205.84" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.097120,1.367010,999,1 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="212.68.25.150" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130816"/>
    </anomaly>
    <anomaly type="suspicious" value="1.329500,1.367960,999,0 0 0 1 0 0 0 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="213.240.193.13" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.971888,1.366160,999,0 0 0 1 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="212.229.70.53" src_port="53"/>
        </slice>
        <from usec="0" sec="1292130001"/>
        <to usec="0" sec="1292130555"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148650,1.288680,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="66.50.119.235" dst_port="21"/>
        </slice>
        <from usec="0" sec="1292130006"/>
        <to usec="0" sec="1292130901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.262750,1.333280,999,1 1 0 1 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="218.17.252.16" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130896"/>
    </anomaly>
    <anomaly type="suspicious" value="1.393750,1.511530,999,0 0 0 0 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="131.19.234.179" src_port="53"/>
            <filter dst_ip="165.232.150.242" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130001"/>
        <to usec="0" sec="1292130737"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972074,1.238720,999,1 1 0 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="131.19.194.11" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130894"/>
    </anomaly>
    <anomaly type="suspicious" value="1.097120,1.367010,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="133.141.131.92" src_port="53"/>
            <filter dst_ip="133.141.131.92" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130105"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="218.228.236.104" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,010,0 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="218.226.121.38" dst_ip="213.240.196.49" dst_port="8765"/>
            <filter src_ip="197.223.251.58" dst_ip="213.240.196.49" dst_port="8765"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.165010,1.333800,999,1 1 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="213.240.200.12" src_port="53"/>
            <filter dst_ip="213.240.200.12" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130894"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="213.240.200.18" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="213.240.197.24" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="213.240.197.29" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.165010,1.333800,999,1 1 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="212.68.146.229" src_port="53"/>
            <filter dst_ip="212.68.146.229" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130896"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="212.68.1.105" dst_port="27745"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="133.0.35.52" src_port="53"/>
            <filter dst_ip="133.0.35.52" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="213.240.207.126" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.097120,1.367010,010,1 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="28.16.52.245" dst_ip="174.41.165.197" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130883"/>
    </anomaly>
    <anomaly type="suspicious" value="1.097120,1.367010,503,1 0 0 0 0 0 1 1 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="173.46.18.20" dst_ip="58.0.31.50" dst_port="80"/>
            <filter src_ip="173.46.18.20" dst_ip="58.0.31.51" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130577"/>
    </anomaly>
    <anomaly type="suspicious" value="0.973592,1.315140,999,1 1 0 0 0 0 0 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="212.68.25.48" src_port="23593"/>
        </slice>
        <from usec="0" sec="1292130540"/>
        <to usec="0" sec="1292130896"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="215.38.187.230" src_port="25" dst_port="25"/>
        </slice>
        <from usec="0" sec="1292130585"/>
        <to usec="0" sec="1292130631"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="212.229.70.53" dst_ip="3.143.137.107" src_port="53"/>
        </slice>
        <from usec="0" sec="1292130675"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,020,0 0 0 0 0 0 1 1 0 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="174.41.168.209"/>
        </slice>
        <from usec="0" sec="1292130675"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="212.68.6.17" src_port="53"/>
            <filter dst_ip="212.68.6.17" dst_port="53"/>
        </slice>
        <from usec="0" sec="1292130675"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="173.46.18.122" dst_ip="193.0.43.22" dst_port="4447"/>
        </slice>
        <from usec="0" sec="1292130675"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.46.172.203" src_port="53"/>
        </slice>
        <from usec="0" sec="1292130675"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,504,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="37.15.219.96" dst_ip="212.68.148.175" dst_port="443"/>
        </slice>
        <from usec="0" sec="1292130675"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="131.19.208.231" dst_port="10044"/>
        </slice>
        <from usec="0" sec="1292130675"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="131.19.208.254" dst_port="59090"/>
        </slice>
        <from usec="0" sec="1292130675"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,020,0 0 0 0 0 0 1 1 0 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="213.240.200.171"/>
        </slice>
        <from usec="0" sec="1292130675"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="213.240.193.145" dst_port="80"/>
        </slice>
        <from usec="0" sec="1292130675"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,020,0 0 0 0 0 0 1 1 0 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="213.240.206.195"/>
        </slice>
        <from usec="0" sec="1292130000"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164860,1.452930,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="131.19.9.43" dst_ip="69.125.164.60" src_port="80"/>
        </slice>
        <from usec="0" sec="1292130675"/>
        <to usec="0" sec="1292130721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.909814,1.243330,503,1 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="131.19.200.228" src_port="80"/>
            <filter src_ip="131.19.49.87" src_port="80"/>
            <filter dst_ip="12.161.142.131" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.173480,1.276890,503,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="133.17.217.29" dst_ip="192.156.51.72"/>
            <filter dst_ip="192.156.51.72" src_port="80"/>
            <filter src_ip="133.17.217.29" dst_ip="8.49.206.128" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.237040,1.368480,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="173.46.225.212" dst_ip="9.53.50.71" src_port="80"/>
            <filter src_ip="173.46.225.212" dst_ip="0.120.240.98" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.237040,1.368480,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="155.31.14.31" dst_ip="192.156.51.177" src_port="80"/>
            <filter src_ip="155.31.14.31" dst_ip="8.49.202.227" src_port="80"/>
            <filter src_ip="155.31.14.31" dst_ip="8.49.206.166" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.173480,1.276890,503,1 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="192.81.106.30" dst_ip="173.46.112.108" src_port="80" dst_port="50936"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.237040,1.368480,999,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_port="60732" dst_port="1657"/>
            <filter src_port="60732" dst_port="1656"/>
            <filter src_port="60731" dst_port="1657"/>
            <filter src_port="60731" dst_port="1656"/>
            <filter src_ip="173.46.18.1" dst_ip="160.197.165.29" src_port="60732"/>
            <filter src_ip="173.46.18.1" dst_ip="160.197.165.29" src_port="60731"/>
            <filter src_ip="173.46.18.1" dst_ip="160.197.165.29" dst_port="1657"/>
            <filter src_ip="173.46.18.1" dst_ip="160.197.165.29" dst_port="1656"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.237040,1.368480,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="130.11.12.35" dst_ip="8.49.206.7" src_port="80" dst_port="62286"/>
            <filter src_ip="130.11.12.35" dst_ip="8.49.206.7" src_port="80" dst_port="40766"/>
            <filter src_ip="130.11.12.35" dst_ip="8.49.206.7" src_port="80" dst_port="39114"/>
            <filter src_ip="155.31.73.91" dst_ip="8.49.206.7" src_port="80" dst_port="61220"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
