<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.692460,2.049180,503,1 1 1 1 1 0 1 1 1 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="198.48.0.122" dst_port="80"/>
            <filter src_ip="198.48.0.122" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.093400,1.807400,999,1 1 1 1 1 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="172.1.15.79" src_port="25"/>
            <filter src_ip="172.1.15.79" dst_port="25"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="anomalous" value="3.102060,2.285250,503,1 1 0 1 1 1 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="199.107.159.182" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.480710,1.306840,503,1 1 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="171.197.84.128" dst_port="80"/>
            <filter src_ip="171.197.101.190" dst_port="80"/>
            <filter dst_ip="219.186.20.226" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.480090,1.297850,999,1 0 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="199.107.159.128"/>
            <filter dst_ip="5.35.239.99" dst_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.371030,1.989900,503,1 1 1 1 1 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="198.48.48.241" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="anomalous" value="1.476930,1.329700,503,1 1 0 1 1 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="171.197.40.213" dst_port="80"/>
            <filter src_ip="171.197.40.213" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.031510,1.595780,999,1 1 0 1 1 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="199.107.158.115"/>
            <filter src_ip="199.107.145.42"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.512170,1.356350,999,1 1 0 1 1 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="14.35.190.118" dst_port="3544"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623569"/>
    </anomaly>
    <anomaly type="anomalous" value="2.986050,2.266480,503,1 1 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="199.107.159.143" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.102060,2.285250,503,1 1 0 1 1 1 1 1 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="199.107.159.182" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.102060,2.285250,503,1 1 0 1 1 1 1 1 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="199.107.148.4" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.834920,1.726510,503,1 1 1 1 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="171.197.163.192" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296622830"/>
        <to usec="0" sec="1296623624"/>
    </anomaly>
    <anomaly type="anomalous" value="2.034270,1.576780,010,1 1 0 1 0 0 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.107.158.121"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.763990,1.503540,010,1 1 0 1 0 0 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="199.107.145.42"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.763990,1.503540,503,1 1 0 1 0 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="171.197.128.46" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.023390,2.240550,010,1 1 1 1 1 0 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="129.109.236.148" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.512170,1.356350,999,1 1 0 1 1 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter src_ip="107.101.47.95" dst_ip="198.60.0.176"/>
            <filter dst_ip="198.60.0.176" dst_port="9375"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623628"/>
    </anomaly>
    <anomaly type="anomalous" value="1.372850,1.313390,999,1 0 0 1 1 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="142.21.172.110" src_port="6060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.992680,1.789140,503,1 1 1 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="80"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="anomalous" value="1.877790,1.591440,999,1 1 0 1 1 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="199.107.144.30" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623627"/>
    </anomaly>
    <anomaly type="anomalous" value="2.939080,2.273760,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="187.165.70.38" src_port="80"/>
            <filter dst_ip="218.13.82.130" src_port="80"/>
            <filter dst_ip="218.13.82.12" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.939080,2.273760,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="199.107.159.140" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.020910,1.590210,503,1 1 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="199.107.159.142" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.068090,1.787490,503,1 1 1 1 1 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="171.197.84.177" dst_ip="198.49.0.181" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.368290,1.252050,503,1 1 0 1 0 0 1 1 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="198.60.0.178" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.512170,1.356350,999,1 1 0 1 1 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="198.60.0.176" src_port="9375"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="anomalous" value="3.599710,2.709680,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="46.176.181.93" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.371030,1.989900,999,1 1 1 1 1 0 1 1 1 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="201.71.73.136"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="anomalous" value="2.995100,2.257080,999,1 1 0 1 1 1 1 1 1 1 1 0,ptmp">
        <slice>
            <filter src_ip="199.107.22.209" src_port="58584"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.584510,1.498930,999,1 1 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="171.197.118.59" src_port="53"/>
            <filter src_ip="171.197.118.59" dst_port="53"/>
            <filter src_ip="172.1.209.10" src_port="53"/>
            <filter src_port="53" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="anomalous" value="2.188690,1.616840,503,1 1 0 1 0 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="199.107.148.4" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.372850,1.313390,999,1 0 0 1 1 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="142.21.172.110" dst_port="6060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.068090,1.787490,504,1 1 1 1 1 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="199.107.145.136" dst_ip="179.208.207.174" dst_port="443"/>
            <filter src_ip="172.247.0.78" dst_ip="179.208.207.174" dst_port="443"/>
            <filter src_ip="172.247.2.100" dst_ip="179.208.207.174" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.939080,2.273760,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="171.197.26.130" src_port="80"/>
            <filter dst_ip="171.197.26.130" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.597430,2.085440,503,0 0 0 1 1 1 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="218.130.194.61" dst_ip="142.21.206.136" src_port="80" dst_port="55122"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.935960,2.256950,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="172.1.159.33" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.946140,1.576590,503,1 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="199.107.159.141" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.939080,2.273760,020,0 0 0 1 1 1 0 0 0 1 1 1,icmp_error">
        <slice>
            <filter dst_ip="128.141.170.77" dst_port="80"/>
            <filter dst_ip="128.141.170.77"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.410700,1.340360,503,1 0 0 1 1 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="198.48.48.241" src_port="80"/>
            <filter dst_ip="198.48.48.241" src_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623648"/>
    </anomaly>
    <anomaly type="anomalous" value="1.613140,1.322920,503,1 0 0 1 0 0 1 1 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.107.159.143" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.877790,1.591440,999,1 1 0 1 1 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.107.158.115"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="anomalous" value="1.512170,1.356350,999,1 1 0 1 1 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_port="53"/>
            <filter dst_ip="199.107.149.54" dst_port="53"/>
            <filter dst_ip="140.230.240.95" dst_port="53"/>
            <filter dst_ip="140.230.240.94" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623627"/>
    </anomaly>
    <anomaly type="anomalous" value="1.906810,1.453330,503,0 0 0 1 1 0 1 1 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="198.60.0.178" dst_port="80"/>
            <filter src_ip="198.60.1.126" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.877790,1.591440,503,1 1 0 1 1 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="171.197.30.102" src_port="80"/>
            <filter src_ip="171.197.30.102" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="anomalous" value="1.487980,1.484480,999,1 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="123" dst_port="123"/>
            <filter src_ip="172.1.80.72" dst_ip="199.59.105.30" src_port="123"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="anomalous" value="2.128270,1.937230,020,1 1 1 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="214.170.43.143"/>
        </slice>
        <from usec="0" sec="1296623059"/>
        <to usec="0" sec="1296623648"/>
    </anomaly>
    <anomaly type="anomalous" value="2.128270,1.937230,999,1 1 1 0 0 0 1 1 1 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="201.71.73.138"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="anomalous" value="1.797080,1.577830,503,1 0 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="199.107.159.128" dst_port="80"/>
            <filter dst_ip="9.52.22.139" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="anomalous" value="2.031510,1.595780,503,1 1 0 1 1 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="171.197.225.5" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.964680,1.587220,999,0 0 0 1 0 0 1 1 1 1 1 0,ptmp">
        <slice>
            <filter src_ip="198.60.0.20" src_port="14565"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.618810,1.351400,999,0 0 0 1 0 0 1 1 0 1 1 0,ptpposcaUDP">
        <slice>
            <filter src_ip="32.172.243.106" dst_ip="198.60.0.20"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.487980,1.484480,999,1 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="199.107.145.42"/>
            <filter src_ip="198.60.18.37"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="anomalous" value="1.379500,1.342070,503,0 0 0 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="168.132.17.210" src_port="80"/>
            <filter src_ip="168.132.17.210" src_port="443"/>
            <filter src_ip="133.82.251.63" dst_ip="142.21.32.65" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.383560,1.319420,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="198.62.80.182" dst_ip="198.60.8.137" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.972580,1.753200,020,1 1 1 0 0 0 1 1 0 1 0 0,icmp_error">
        <slice>
            <filter src_ip="199.168.76.53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.950840,1.600560,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="199.107.145.207" src_port="80"/>
            <filter dst_ip="199.107.145.207" dst_port="50501"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.660280,1.540360,999,0 0 0 0 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_port="5060" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.946140,1.576590,503,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="199.107.159.142" src_port="80"/>
            <filter dst_ip="105.18.233.42" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.348740,1.320510,503,1 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="106.32.209.168" dst_ip="172.0.90.150" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.383560,1.319420,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="5.241.72.44" dst_ip="142.21.174.221" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.926300,1.601460,503,1 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="142.21.62.17" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.188690,1.616840,503,1 1 0 1 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="199.107.152.118" dst_port="80"/>
            <filter dst_ip="199.107.152.118" dst_port="53"/>
            <filter dst_ip="199.107.159.141" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.188690,1.616840,503,1 1 0 1 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="171.197.220.209" dst_port="80"/>
            <filter src_ip="198.60.138.151" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.939080,2.273760,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="170.37.138.67" dst_ip="218.13.82.42"/>
            <filter src_ip="187.165.75.83" src_port="80"/>
            <filter dst_ip="218.13.82.42" src_port="80"/>
            <filter src_ip="170.37.138.67" dst_ip="12.81.24.181" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.986050,2.266480,503,1 1 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="172.1.15.34" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.255240,1.234710,503,1 0 0 1 0 0 1 1 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="198.60.0.178" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.355500,1.349040,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="171.197.217.238" dst_ip="13.145.6.208" src_port="80"/>
            <filter src_ip="171.197.217.238" dst_ip="12.81.24.88" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.355500,1.349040,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="172.5.204.10" dst_ip="218.13.82.152" src_port="80" dst_port="51253"/>
            <filter src_ip="172.5.204.10" dst_ip="218.13.82.152" src_port="80" dst_port="41590"/>
            <filter src_ip="172.5.204.10" dst_ip="218.13.82.152" src_port="80" dst_port="40183"/>
            <filter src_ip="172.5.204.10" dst_ip="31.144.226.56" src_port="80" dst_port="63558"/>
            <filter src_ip="172.5.204.10" dst_ip="12.81.29.82" src_port="80" dst_port="50027"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.355500,1.349040,501,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="198.144.162.87" dst_ip="172.0.85.195" src_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.946140,1.576590,503,1 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="199.107.152.118" src_port="80"/>
            <filter src_ip="199.107.152.118" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.355500,1.349040,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="219.201.144.43" dst_ip="172.247.11.192" src_port="80" dst_port="53008"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.355500,1.349040,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="5.35.10.38" dst_ip="142.21.132.83" src_port="80" dst_port="52660"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.946140,1.576590,503,1 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="171.197.220.212" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.355500,1.349040,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="219.246.170.111" dst_ip="171.197.215.13" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.931050,1.625070,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="171.197.18.69" src_port="80"/>
            <filter src_ip="107.85.134.40" dst_ip="172.0.90.148" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.837010,2.193910,010,1 1 1 0 0 0 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="107.27.1.165" src_port="6000" dst_port="9415"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.376930,1.290230,503,1 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="142.21.175.138" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.931050,1.625070,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="198.60.138.151" src_port="80"/>
            <filter dst_ip="198.60.138.151" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.931050,1.625070,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="171.197.33.122" dst_ip="198.49.58.233" dst_port="80"/>
            <filter src_ip="172.247.92.59" dst_ip="198.49.58.233" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.960020,1.563040,503,1 0 0 1 0 0 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="198.48.0.122" src_port="53"/>
            <filter dst_ip="198.48.0.122" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.355500,1.349040,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="12.81.29.145" src_port="53"/>
            <filter src_ip="171.197.196.160" dst_ip="12.81.29.145" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.355500,1.349040,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="172.1.157.65" dst_ip="12.81.24.240" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.355500,1.349040,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="172.5.13.83" dst_ip="12.81.24.19" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.931050,1.625070,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="171.197.197.2" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.925980,2.291080,503,0 0 0 0 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="187.165.44.82" dst_ip="218.13.82.220" src_port="80" dst_port="45941"/>
            <filter src_ip="187.165.44.82" dst_ip="12.81.29.81" src_port="80" dst_port="54673"/>
            <filter src_ip="172.5.13.66" dst_ip="218.13.82.220" src_port="80" dst_port="52631"/>
            <filter src_ip="172.5.117.201" dst_ip="218.13.82.220" src_port="80" dst_port="49341"/>
            <filter src_ip="171.197.160.92" dst_ip="218.13.82.220" src_port="80" dst_port="62824"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.931050,1.625070,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="27.254.114.76" dst_ip="142.21.186.106"/>
            <filter src_ip="27.254.114.76" src_port="80"/>
            <filter dst_ip="142.21.186.106" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.092890,1.277830,503,1 1 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="142.21.174.221" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296622991"/>
        <to usec="0" sec="1296623579"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043590,1.249510,503,1 1 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="142.21.174.18" dst_port="80"/>
            <filter dst_ip="194.171.169.16" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.613100,1.746600,503,0 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="171.197.204.160" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296622850"/>
        <to usec="0" sec="1296623450"/>
    </anomaly>
    <anomaly type="suspicious" value="1.607420,1.724660,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="171.197.81.79" dst_port="80"/>
            <filter src_ip="171.197.81.79" dst_ip="168.75.104.11" dst_port="443"/>
        </slice>
        <from usec="0" sec="1296622953"/>
        <to usec="0" sec="1296623502"/>
    </anomaly>
    <anomaly type="suspicious" value="0.947538,1.260850,503,1 0 0 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="171.197.96.170" dst_port="80"/>
            <filter dst_ip="14.35.98.165" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.607420,1.724660,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="171.197.209.197" dst_port="25"/>
            <filter src_ip="171.197.209.197" dst_ip="12.81.29.187" src_port="80"/>
        </slice>
        <from usec="0" sec="1296623225"/>
        <to usec="0" sec="1296623418"/>
    </anomaly>
    <anomaly type="suspicious" value="1.512350,1.712110,503,1 0 1 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="13.145.17.50" dst_ip="199.107.144.89" dst_port="80"/>
            <filter src_ip="1.234.53.26" dst_ip="199.107.144.89" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296622808"/>
        <to usec="0" sec="1296623583"/>
    </anomaly>
    <anomaly type="suspicious" value="1.127500,1.246520,999,1 1 0 1 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="199.107.149.47" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.092890,1.277830,999,1 1 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.0.73.175" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623255"/>
    </anomaly>
    <anomaly type="suspicious" value="1.607420,1.724660,504,1 1 1 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="171.197.43.13" dst_port="80"/>
            <filter src_ip="171.197.43.13" dst_port="443"/>
            <filter dst_ip="168.75.103.178" dst_port="80"/>
            <filter dst_ip="168.75.103.178" dst_port="443"/>
        </slice>
        <from usec="0" sec="1296622861"/>
        <to usec="0" sec="1296623552"/>
    </anomaly>
    <anomaly type="suspicious" value="1.607420,1.724660,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="142.21.72.216" dst_ip="217.58.204.75" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296623419"/>
        <to usec="0" sec="1296623444"/>
    </anomaly>
    <anomaly type="suspicious" value="1.607420,1.724660,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="171.197.67.235" dst_ip="193.199.34.212" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296623393"/>
        <to usec="0" sec="1296623430"/>
    </anomaly>
    <anomaly type="suspicious" value="1.631140,1.701590,999,1 1 1 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="142.21.105.153" dst_ip="6.131.165.229" dst_port="25"/>
        </slice>
        <from usec="0" sec="1296622837"/>
        <to usec="0" sec="1296623555"/>
    </anomaly>
    <anomaly type="suspicious" value="1.631140,1.701590,010,1 1 1 1 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="41.131.74.254" src_port="6000" dst_port="9415"/>
        </slice>
        <from usec="0" sec="1296623044"/>
        <to usec="0" sec="1296623047"/>
    </anomaly>
    <anomaly type="suspicious" value="1.607420,1.724660,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="35.99.247.239" dst_port="25"/>
        </slice>
        <from usec="0" sec="1296622966"/>
        <to usec="0" sec="1296622970"/>
    </anomaly>
    <anomaly type="suspicious" value="1.141080,1.336900,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.82.253.191" src_port="80"/>
            <filter src_ip="133.82.253.191" src_port="443"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.133030,1.308110,503,1 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="142.21.10.129" src_port="80"/>
        </slice>
        <from usec="0" sec="1296622803"/>
        <to usec="0" sec="1296623534"/>
    </anomaly>
    <anomaly type="suspicious" value="1.461940,1.510870,503,1 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.107.158.114" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623619"/>
    </anomaly>
    <anomaly type="suspicious" value="1.631140,1.701590,010,1 1 1 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="215.67.146.157" dst_port="22"/>
        </slice>
        <from usec="0" sec="1296622801"/>
        <to usec="0" sec="1296623268"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.127.77.95" dst_ip="199.107.159.141" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.631140,1.701590,010,1 1 1 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="25"/>
            <filter src_ip="171.197.97.19" src_port="53"/>
        </slice>
        <from usec="0" sec="1296622807"/>
        <to usec="0" sec="1296623553"/>
    </anomaly>
    <anomaly type="suspicious" value="0.932375,1.199620,503,1 0 0 1 0 0 0 0 0 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="142.21.10.128" dst_ip="105.18.233.42" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.257120,1.324490,503,1 1 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="172.247.91.168" dst_ip="22.56.98.250" dst_port="80"/>
            <filter src_ip="172.247.91.168" dst_ip="84.22.66.130" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296623135"/>
        <to usec="0" sec="1296623489"/>
    </anomaly>
    <anomaly type="suspicious" value="1.133030,1.308110,503,1 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="13.145.17.193" dst_ip="172.247.97.201" src_port="40457" dst_port="80"/>
            <filter src_ip="13.145.17.193" dst_ip="172.247.97.201" src_port="40056" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296622858"/>
        <to usec="0" sec="1296622868"/>
    </anomaly>
    <anomaly type="suspicious" value="1.141080,1.336900,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="171.197.72.0" dst_ip="194.221.80.61" src_port="49947" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622998"/>
    </anomaly>
    <anomaly type="suspicious" value="1.141080,1.336900,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="168.132.81.146" dst_ip="172.247.64.251" src_port="80"/>
            <filter src_ip="168.75.104.11" dst_ip="172.247.64.251" src_port="80"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623075"/>
    </anomaly>
    <anomaly type="suspicious" value="1.141080,1.336900,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="187.165.39.70" dst_ip="12.81.24.13" src_port="80"/>
        </slice>
        <from usec="0" sec="1296622816"/>
        <to usec="0" sec="1296623266"/>
    </anomaly>
    <anomaly type="suspicious" value="1.141080,1.336900,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="172.1.14.12" src_port="80"/>
        </slice>
        <from usec="0" sec="1296622804"/>
        <to usec="0" sec="1296623440"/>
    </anomaly>
    <anomaly type="suspicious" value="1.141080,1.336900,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="172.247.0.78" dst_ip="219.236.136.70" dst_port="443"/>
        </slice>
        <from usec="0" sec="1296623004"/>
        <to usec="0" sec="1296623305"/>
    </anomaly>
    <anomaly type="suspicious" value="1.141080,1.336900,020,0 0 0 1 1 0 0 0 0 0 0 0,sptpDoSIC">
        <slice>
            <filter src_ip="199.107.148.180" dst_ip="201.59.2.4"/>
        </slice>
        <from usec="0" sec="1296623172"/>
        <to usec="0" sec="1296623273"/>
    </anomaly>
    <anomaly type="suspicious" value="1.141080,1.336900,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="171.197.222.35" dst_ip="193.57.16.12" dst_port="80"/>
            <filter src_ip="171.197.222.32" dst_ip="193.57.16.12" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296622813"/>
        <to usec="0" sec="1296623625"/>
    </anomaly>
    <anomaly type="suspicious" value="1.141080,1.336900,503,0 0 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="142.21.58.24" src_port="80"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623556"/>
    </anomaly>
    <anomaly type="suspicious" value="1.141080,1.336900,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="199.107.159.128" dst_ip="108.181.161.166" src_port="63636" dst_port="49599"/>
            <filter src_ip="199.107.159.128" dst_ip="108.181.161.166" src_port="63607" dst_port="49599"/>
            <filter src_ip="199.107.159.128" dst_ip="108.181.161.166" src_port="63597" dst_port="49599"/>
        </slice>
        <from usec="0" sec="1296623164"/>
        <to usec="0" sec="1296623621"/>
    </anomaly>
    <anomaly type="suspicious" value="1.257120,1.324490,503,1 1 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="142.21.202.120" dst_ip="219.201.145.95" src_port="53572" dst_port="80"/>
            <filter src_ip="142.21.202.120" dst_ip="219.201.145.95" src_port="53570" dst_port="80"/>
            <filter src_ip="142.21.202.120" dst_ip="218.13.28.59" src_port="53575" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296623281"/>
        <to usec="0" sec="1296623628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="142.21.10.140" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.996476,1.259700,999,0 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="198.60.141.11" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.996476,1.259700,999,0 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="199.107.144.30" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623532"/>
    </anomaly>
    <anomaly type="suspicious" value="1.263650,1.344260,020,0 0 0 1 1 0 1 0 0 0 0 0,ttl_error">
        <slice>
            <filter src_ip="172.192.68.46"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623358"/>
    </anomaly>
    <anomaly type="suspicious" value="1.141080,1.336900,011,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="199.107.158.114" dst_ip="210.81.65.249"/>
            <filter src_ip="199.107.158.114" dst_ip="45.21.88.115"/>
            <filter src_ip="199.107.158.115" dst_ip="210.81.65.249"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623448"/>
    </anomaly>
    <anomaly type="suspicious" value="1.349390,1.487990,999,0 0 0 1 0 0 1 0 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="198.179.104.26" dst_ip="10.5.100.10" src_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="171.197.160.143" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623070"/>
        <to usec="0" sec="1296623341"/>
    </anomaly>
    <anomaly type="suspicious" value="0.884796,1.251860,503,1 1 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="198.60.8.137" dst_ip="198.62.80.182" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296623520"/>
        <to usec="0" sec="1296623566"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,011,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="199.107.132.15" src_port="5000"/>
            <filter src_ip="199.107.132.15"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,020,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="199.107.148.101" dst_port="53"/>
            <filter src_ip="199.107.148.101"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468180,1.535860,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="198.60.18.209" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623610"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468180,1.535860,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="171.197.67.118" src_port="5027"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.127500,1.246520,502,1 1 0 1 0 0 1 1 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="40.21.176.199" dst_port="22"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468180,1.535860,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="28.203.224.233" src_port="80" dst_port="3072"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="172.192.69.83" src_port="53"/>
            <filter dst_ip="172.192.69.83" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.996476,1.259700,999,0 0 0 1 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="171.197.228.201" src_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622998"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,020,0 0 0 0 0 0 1 1 0 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="198.48.42.127"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623566"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,020,0 0 0 0 0 0 1 1 0 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="199.107.149.76"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="171.197.67.118" dst_port="5027"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.987251,1.229100,504,1 0 0 1 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="171.197.163.213" dst_ip="65.205.121.166" dst_port="443"/>
            <filter src_ip="198.48.0.122" dst_ip="65.205.121.166" dst_port="443"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623622"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,010,0 0 0 0 0 0 1 1 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="171.197.204.59" dst_port="443"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,010,0 0 0 0 0 0 1 1 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="199.107.132.15" dst_port="5000"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,502,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="217.96.111.115" src_port="22"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="172.0.64.102" dst_port="30036"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.987251,1.229100,999,1 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="198.60.1.126" dst_port="8183"/>
            <filter dst_ip="198.60.1.126" dst_port="30471"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.835591,1.251850,999,0 0 0 1 0 0 0 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="198.60.18.33" dst_port="6881"/>
            <filter dst_ip="198.60.18.33" dst_port="40515"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623358"/>
    </anomaly>
    <anomaly type="suspicious" value="0.947538,1.260850,999,1 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="198.60.18.37"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623275"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="171.197.118.59" src_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="171.197.137.111" src_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="142.21.57.24" src_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="199.107.149.45" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="172.1.15.73" src_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="172.1.209.10" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296622846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.494120,1.509910,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="199.107.158.120" src_port="23269"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="172.1.20.27" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623341"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="171.197.162.17" src_port="35503"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623341"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="106.214.238.3" src_port="80"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.630580,1.694700,503,1 0 1 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="171.197.101.86"/>
            <filter src_ip="171.197.204.160" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="142.21.56.3" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623341"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="219.205.189.234" src_port="29000"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623341"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="128.114.173.159" src_port="80"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623341"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="219.240.90.239" src_port="80"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623341"/>
    </anomaly>
    <anomaly type="suspicious" value="0.996476,1.259700,999,0 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="198.179.104.26" src_port="53"/>
            <filter src_ip="171.197.228.201" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_port="5060" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623341"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="28.203.224.233" src_port="80" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623341"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="31.9.161.86" src_port="443" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623341"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="31.9.161.86" src_port="443" dst_port="3072"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623341"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="172.1.15.73" src_port="53"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623341"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,503,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="171.197.55.211" dst_port="53"/>
            <filter src_ip="171.197.55.211" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="172.1.154.101" src_port="51284"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468180,1.535860,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="171.197.137.111" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="171.197.218.88" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="171.197.228.201" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="172.247.220.217" dst_ip="2.28.37.49" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="199.107.156.236" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468180,1.535860,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="171.197.170.248" dst_ip="172.229.117.50" src_port="80"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="172.1.15.28" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="106.214.238.3" src_port="80"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468180,1.535860,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="198.48.0.122" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="142.21.56.3" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,503,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="171.197.163.105" dst_port="80"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468180,1.535860,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="219.205.189.234" src_port="29000"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468180,1.535860,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="198.60.141.11" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="128.114.173.159" src_port="80"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="219.240.90.239" src_port="80"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="106.32.209.146" dst_ip="172.0.90.151" src_port="1935"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957146,1.290690,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="198.179.104.26" src_port="53"/>
            <filter src_ip="171.197.118.59" src_port="53"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468180,1.535860,999,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="142.21.74.75" src_port="8000" dst_port="8000"/>
            <filter dst_ip="142.21.74.75" src_port="8000" dst_port="8000"/>
            <filter dst_ip="142.21.74.75" src_port="8000"/>
        </slice>
        <from usec="0" sec="1296623610"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468180,1.535860,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="28.203.224.233" src_port="80" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468180,1.535860,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="31.9.161.86" src_port="443" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468180,1.535860,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="31.9.161.86" src_port="443" dst_port="3072"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468180,1.535860,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="199.107.149.54" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468180,1.535860,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="198.60.141.11" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623295"/>
        <to usec="0" sec="1296623341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.461940,1.510870,999,1 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.209.84.98" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296622800"/>
        <to usec="0" sec="1296623572"/>
    </anomaly>
    <anomaly type="suspicious" value="1.235350,1.481350,999,0 0 0 1 0 0 0 0 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="171.197.118.59" src_port="53"/>
            <filter dst_ip="219.244.238.42" src_port="53"/>
        </slice>
        <from usec="0" sec="1296622801"/>
        <to usec="0" sec="1296623524"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468180,1.535860,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="171.197.118.51" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468180,1.535860,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="199.107.144.30" dst_port="53"/>
        </slice>
        <from usec="0" sec="1296623655"/>
        <to usec="0" sec="1296623701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.890218,1.232130,503,1 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="171.197.144.40" dst_ip="14.35.151.14" dst_port="80"/>
            <filter src_ip="171.197.144.40" dst_ip="14.34.35.0" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900437,1.262660,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="172.5.64.11"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.942138,1.230960,503,0 0 0 1 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="172.5.232.100" dst_ip="12.81.29.200" src_port="80"/>
            <filter src_ip="172.5.232.100" dst_ip="31.144.154.16" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043590,1.249510,504,1 1 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="179.208.207.174" dst_ip="199.107.145.136" src_port="443"/>
            <filter src_ip="179.208.207.174" dst_ip="172.247.0.78" src_port="443"/>
            <filter src_ip="179.208.207.174" dst_ip="172.247.2.100" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900437,1.262660,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="142.21.74.144"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.942138,1.230960,503,0 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="136.127.77.0" src_port="80"/>
            <filter src_ip="142.21.132.10" dst_ip="219.205.19.169" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043590,1.249510,503,1 1 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="142.21.10.140" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.262510,1.265180,503,0 0 0 1 0 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="198.48.0.122" src_port="80"/>
            <filter dst_ip="198.60.143.101" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900437,1.262660,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="106.32.209.171"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900437,1.262660,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="15.2.204.54"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900437,1.262660,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="5.35.13.170"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900437,1.262660,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="40.160.4.71"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900437,1.262660,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="115.162.24.27" dst_ip="171.197.141.60" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900437,1.262660,999,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="140.230.200.207"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.942138,1.230960,503,0 0 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.107.150.198" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900437,1.262660,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="187.165.76.169" dst_ip="12.81.24.160" src_port="80"/>
            <filter src_ip="187.165.33.128" dst_ip="12.81.24.160" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900437,1.262660,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="8.143.228.32"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900437,1.262660,999,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="18.214.173.113"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
