<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.561200,1.904400,503,1 1 0 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="206.175.14.164" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.761000,2.110850,010,1 1 1 1 1 1 1 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="209.144.32.230" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.424350,1.908820,503,1 1 1 1 1 0 1 1 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.175.14.164" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.059610,1.836370,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="207.10.215.84" dst_ip="12.185.78.168" src_port="49518" dst_port="25"/>
            <filter src_ip="207.10.215.84" dst_ip="12.185.78.168" src_port="49094" dst_port="25"/>
            <filter src_ip="207.10.215.84" dst_ip="172.31.111.210"/>
            <filter src_ip="207.10.215.84" dst_ip="37.25.4.14" src_port="25" dst_port="16382"/>
            <filter src_ip="207.10.215.84" dst_ip="206.32.207.20" src_port="25" dst_port="12897"/>
        </slice>
        <from usec="0" sec="1299128498"/>
        <to usec="0" sec="1299128501"/>
    </anomaly>
    <anomaly type="anomalous" value="1.624640,1.421100,999,1 1 0 1 1 0 1 0 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="196.64.41.186"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299129225"/>
    </anomaly>
    <anomaly type="anomalous" value="2.059610,1.836370,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="180.163.223.180" src_port="12200" dst_port="9415"/>
        </slice>
        <from usec="0" sec="1299128545"/>
        <to usec="0" sec="1299128546"/>
    </anomaly>
    <anomaly type="anomalous" value="2.112830,1.836770,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="172.20.32.73" src_port="2425" dst_port="2425"/>
        </slice>
        <from usec="0" sec="1299128986"/>
        <to usec="0" sec="1299129032"/>
    </anomaly>
    <anomaly type="anomalous" value="2.059610,1.836370,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="49.225.88.60" src_port="6000" dst_port="9415"/>
        </slice>
        <from usec="0" sec="1299128801"/>
        <to usec="0" sec="1299128802"/>
    </anomaly>
    <anomaly type="anomalous" value="2.059610,1.836370,011,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="206.35.176.82" src_port="443"/>
        </slice>
        <from usec="0" sec="1299128743"/>
        <to usec="0" sec="1299128744"/>
    </anomaly>
    <anomaly type="anomalous" value="2.059610,1.836370,504,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.52.28.203" dst_ip="200.118.145.40" dst_port="443"/>
        </slice>
        <from usec="0" sec="1299128742"/>
        <to usec="0" sec="1299128744"/>
    </anomaly>
    <anomaly type="anomalous" value="1.500660,1.449400,999,0 1 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.175.6.97" src_port="53"/>
            <filter dst_ip="166.224.135.143" src_port="53"/>
            <filter dst_ip="164.6.221.148" src_port="53"/>
        </slice>
        <from usec="0" sec="1299128806"/>
        <to usec="0" sec="1299128907"/>
    </anomaly>
    <anomaly type="anomalous" value="2.248740,1.847200,503,1 1 1 1 1 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="136.52.38.163" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.538610,2.030830,010,1 1 1 0 0 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="76.43.189.201" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.059610,1.836370,054,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="206.35.176.202" src_port="443"/>
        </slice>
        <from usec="0" sec="1299128981"/>
        <to usec="0" sec="1299128982"/>
    </anomaly>
    <anomaly type="anomalous" value="1.720370,1.536800,999,0 0 0 1 1 1 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="206.175.168.98" src_port="58584"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.901500,1.538640,010,1 0 0 1 1 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="56.67.166.16" dst_port="80"/>
            <filter src_ip="56.67.166.16" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.711390,1.406270,999,1 0 0 1 1 0 1 1 0 1 1 0,ntscUDP">
        <slice>
            <filter src_ip="136.52.245.1" src_port="53"/>
            <filter src_ip="136.52.245.1" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.517350,1.338180,503,1 0 0 1 1 0 1 1 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="136.52.45.106" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.083390,2.303350,010,1 1 1 1 1 1 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="72.109.1.125" src_port="6000" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.603670,1.478970,503,0 0 0 1 0 0 1 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="207.2.16.26" dst_ip="2.240.131.218" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.363680,1.923070,999,1 1 1 1 1 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="207.220.235.246" src_port="53"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299129229"/>
    </anomaly>
    <anomaly type="anomalous" value="3.083390,2.303350,010,1 1 1 1 1 1 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="57.0.152.0" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.878450,1.481510,999,1 1 0 1 1 0 1 1 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="206.175.15.122"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.156300,1.779580,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="154.17.212.114" dst_ip="219.184.163.146" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.564330,1.553990,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="142.22.165.123" dst_ip="2.21.85.70" src_port="80" dst_port="64546"/>
        </slice>
        <from usec="0" sec="1299128434"/>
        <to usec="0" sec="1299128508"/>
    </anomaly>
    <anomaly type="anomalous" value="2.156300,1.779580,503,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="142.0.238.245" dst_ip="219.184.163.142" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.156300,1.779580,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="207.2.16.26" src_port="80"/>
            <filter dst_ip="207.2.16.26" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.356660,1.317770,503,0 0 0 1 1 0 1 1 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.175.2.111" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.156300,1.779580,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="219.184.163.137" src_port="80"/>
            <filter src_ip="154.17.221.73" dst_ip="0.8.205.141" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.834160,1.595980,020,0 0 0 1 1 1 0 0 0 1 1 0,ttl_error">
        <slice>
            <filter dst_ip="28.248.177.193"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.156300,1.779580,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="136.52.68.180" dst_ip="0.8.202.40" src_port="80"/>
            <filter src_ip="136.52.68.180" dst_ip="1.48.116.41" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.654580,1.536320,503,0 0 0 1 1 1 0 0 0 1 0 0,malphfl">
        <slice>
            <filter src_ip="4.49.155.6" dst_ip="164.6.66.140" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.834160,1.595980,503,0 0 0 1 1 1 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="207.2.16.26" dst_ip="86.18.83.60" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.156300,1.779580,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="142.22.165.123" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.564330,1.553990,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="154.17.210.124" dst_ip="219.184.163.131" src_port="80"/>
        </slice>
        <from usec="0" sec="1299128423"/>
        <to usec="0" sec="1299128954"/>
    </anomaly>
    <anomaly type="anomalous" value="2.052890,1.611630,503,1 0 0 1 1 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="136.52.65.1" dst_port="80"/>
            <filter dst_ip="207.3.98.173" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.454360,1.387460,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="76.32.84.204" dst_port="139"/>
        </slice>
        <from usec="0" sec="1299128806"/>
        <to usec="0" sec="1299128852"/>
    </anomaly>
    <anomaly type="anomalous" value="2.207190,1.779990,503,0 0 0 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="206.175.9.146" src_port="80"/>
            <filter src_ip="206.175.9.146" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.250040,1.898340,999,1 1 1 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="206.175.3.113" src_port="53"/>
            <filter dst_ip="206.175.3.113" dst_port="53"/>
        </slice>
        <from usec="0" sec="1299128446"/>
        <to usec="0" sec="1299129259"/>
    </anomaly>
    <anomaly type="anomalous" value="1.834160,1.595980,503,0 0 0 1 1 1 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="136.52.208.240" dst_port="80"/>
            <filter dst_ip="164.6.66.75" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.229700,3.623300,999,1 1 0 1 1 1 1 1 1 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.175.15.122"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.052890,1.611630,503,1 0 0 1 1 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="206.175.14.148"/>
            <filter dst_ip="195.193.191.214" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.647360,1.467990,503,1 1 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="164.6.236.5" dst_port="80"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128905"/>
    </anomaly>
    <anomaly type="anomalous" value="1.393830,1.352360,503,0 0 0 0 0 0 1 1 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.175.9.146" dst_port="80"/>
            <filter dst_ip="206.175.9.146" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.697260,3.431450,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.175.6.183" dst_port="58228"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="anomalous" value="3.955790,3.489790,020,1 1 0 0 0 0 1 1 1 1 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="72.109.1.125"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.156300,1.779580,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="142.22.29.47" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.305260,1.249310,503,1 0 0 1 1 0 1 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="206.175.2.111" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.796730,1.564810,503,0 0 0 0 0 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="207.2.63.209" src_port="53"/>
            <filter dst_ip="207.2.63.209" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.551640,1.489030,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="136.52.114.42" src_port="80"/>
            <filter src_ip="155.39.106.28" dst_ip="136.52.114.42" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.532880,1.478470,503,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="218.129.57.27" dst_ip="136.52.119.75" src_port="80" dst_port="56727"/>
            <filter src_ip="218.129.57.27" dst_ip="136.52.119.67" src_port="80" dst_port="53865"/>
            <filter src_ip="205.138.65.23" dst_ip="136.52.119.75" src_port="1183" dst_port="445"/>
            <filter src_ip="218.218.242.170" dst_ip="136.52.119.75" src_port="1718" dst_port="445"/>
            <filter src_ip="218.129.57.24" dst_ip="136.52.119.75" src_port="80" dst_port="56919"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.477700,1.367090,999,1 1 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="164.6.151.237" dst_port="443"/>
            <filter dst_ip="164.6.151.237" src_port="8000" dst_port="8000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.570740,2.023470,010,1 1 1 1 0 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="49.156.6.18" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.551640,1.489030,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="207.10.57.62" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.156300,1.779580,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="142.0.74.223" dst_ip="0.8.205.147" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.693920,1.507130,503,1 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="207.2.16.7" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.551640,1.489030,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="218.129.57.28" dst_ip="136.52.106.44" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.551640,1.489030,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="207.2.16.26" dst_ip="201.5.246.49" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.551640,1.489030,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="207.2.16.26" dst_ip="201.5.247.42" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.551640,1.489030,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="219.184.163.188" src_port="80"/>
            <filter src_ip="136.52.76.93" dst_ip="199.78.1.73" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.551640,1.489030,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="154.17.130.76" dst_ip="14.80.171.162" src_port="80" dst_port="46708"/>
            <filter src_ip="142.0.185.160" dst_ip="14.80.171.162" src_port="80" dst_port="34966"/>
            <filter src_ip="136.52.79.212" dst_ip="14.80.171.162" src_port="80" dst_port="40066"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220890,1.443930,503,0 0 0 0 0 0 0 0 0 0 0 1,alphflHTTP">
        <slice>
            <filter src_ip="207.2.16.26" dst_ip="12.191.166.20" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.375900,1.386920,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="136.52.30.169" dst_ip="37.178.128.123" src_port="54900" dst_port="80"/>
            <filter src_ip="136.52.30.169" dst_ip="19.83.249.122" src_port="45937" dst_port="43271"/>
            <filter src_ip="136.52.30.169" dst_ip="209.70.93.47" src_port="54047" dst_port="80"/>
            <filter src_ip="136.52.30.169" dst_ip="168.32.75.92" src_port="54059" dst_port="80"/>
        </slice>
        <from usec="0" sec="1299128905"/>
        <to usec="0" sec="1299128907"/>
    </anomaly>
    <anomaly type="suspicious" value="1.375900,1.386920,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.52.78.179" dst_ip="207.8.106.221" dst_port="80"/>
        </slice>
        <from usec="0" sec="1299128904"/>
        <to usec="0" sec="1299128906"/>
    </anomaly>
    <anomaly type="suspicious" value="1.375900,1.386920,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="9.74.160.84" dst_port="445"/>
            <filter src_ip="9.74.160.84" dst_port="139"/>
        </slice>
        <from usec="0" sec="1299129206"/>
        <to usec="0" sec="1299129262"/>
    </anomaly>
    <anomaly type="suspicious" value="1.375900,1.386920,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="172.20.32.48" src_port="2425" dst_port="2425"/>
        </slice>
        <from usec="0" sec="1299128556"/>
        <to usec="0" sec="1299128669"/>
    </anomaly>
    <anomaly type="suspicious" value="1.375900,1.386920,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="164.6.92.110" dst_ip="168.32.75.86" src_port="64729" dst_port="80"/>
            <filter src_ip="164.6.92.110" dst_ip="66.67.176.141" src_port="60596" dst_port="443"/>
        </slice>
        <from usec="0" sec="1299128743"/>
        <to usec="0" sec="1299128745"/>
    </anomaly>
    <anomaly type="suspicious" value="0.948429,1.197270,503,1 0 0 1 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="206.175.14.159" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="164.6.151.84" dst_ip="63.56.173.19" dst_port="80"/>
            <filter src_ip="164.6.56.23" dst_ip="63.56.173.19" dst_port="80"/>
            <filter src_ip="164.6.236.9" dst_ip="63.56.173.19" dst_port="80"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299128503"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="218.166.78.17" dst_ip="164.6.17.44" src_port="80"/>
        </slice>
        <from usec="0" sec="1299128428"/>
        <to usec="0" sec="1299128448"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="164.6.6.204" dst_ip="217.128.163.126" src_port="80"/>
        </slice>
        <from usec="0" sec="1299128482"/>
        <to usec="0" sec="1299128505"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="154.17.145.158" dst_ip="0.8.202.232" src_port="80" dst_port="63964"/>
            <filter src_ip="154.17.145.158" dst_ip="0.8.202.232" src_port="80" dst_port="45384"/>
            <filter src_ip="206.175.6.120" dst_ip="0.8.202.232" src_port="53" dst_port="47274"/>
            <filter src_ip="142.22.29.47" dst_ip="0.8.202.232" src_port="80" dst_port="64705"/>
        </slice>
        <from usec="0" sec="1299128404"/>
        <to usec="0" sec="1299128540"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887245,1.261360,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299129229"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="12.185.156.62" dst_ip="142.190.36.163" src_port="995" dst_port="56698"/>
            <filter src_ip="168.32.75.49" dst_ip="142.190.36.163" src_port="80" dst_port="56568"/>
        </slice>
        <from usec="0" sec="1299128404"/>
        <to usec="0" sec="1299128619"/>
    </anomaly>
    <anomaly type="suspicious" value="1.091400,1.270400,999,1 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="136.52.19.204" dst_ip="12.185.231.149" dst_port="25"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299129229"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="136.52.31.73" src_port="80"/>
        </slice>
        <from usec="0" sec="1299128425"/>
        <to usec="0" sec="1299128869"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="154.17.145.3" dst_ip="0.8.203.40" src_port="443"/>
        </slice>
        <from usec="0" sec="1299128435"/>
        <to usec="0" sec="1299128947"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.175.2.67" dst_port="53"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299129049"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="164.6.83.20" dst_ip="218.166.79.0" dst_port="80"/>
        </slice>
        <from usec="0" sec="1299129058"/>
        <to usec="0" sec="1299129083"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="164.6.236.8" dst_ip="2.37.20.10" src_port="80" dst_port="61835"/>
        </slice>
        <from usec="0" sec="1299129131"/>
        <to usec="0" sec="1299129137"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="164.6.196.114" dst_port="21246"/>
            <filter src_ip="4.184.132.22" dst_ip="164.6.196.114" src_port="80"/>
        </slice>
        <from usec="0" sec="1299128403"/>
        <to usec="0" sec="1299129217"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="136.52.154.32" dst_ip="218.217.136.236" dst_port="80"/>
        </slice>
        <from usec="0" sec="1299128404"/>
        <to usec="0" sec="1299129227"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="142.22.0.89" dst_ip="168.32.75.31" src_port="62631" dst_port="80"/>
            <filter src_ip="142.22.0.89" dst_ip="168.32.75.31" src_port="62067" dst_port="80"/>
            <filter src_ip="142.22.0.89" dst_ip="168.32.75.31" src_port="60042" dst_port="80"/>
            <filter src_ip="142.190.73.6" dst_ip="168.32.75.31" src_port="3121" dst_port="80"/>
            <filter src_ip="136.52.163.104" dst_ip="168.32.75.31" src_port="60039" dst_port="80"/>
        </slice>
        <from usec="0" sec="1299128420"/>
        <to usec="0" sec="1299129183"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.52.81.100" dst_ip="0.8.195.69" src_port="80"/>
        </slice>
        <from usec="0" sec="1299128504"/>
        <to usec="0" sec="1299129118"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="164.6.23.32" dst_ip="9.28.178.103" src_port="3514" dst_port="12227"/>
        </slice>
        <from usec="0" sec="1299128668"/>
        <to usec="0" sec="1299129228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="206.175.3.113" dst_ip="77.170.152.209" dst_port="53"/>
            <filter src_ip="206.175.6.97" dst_ip="77.170.152.209" dst_port="53"/>
            <filter src_ip="207.10.63.156" dst_ip="77.170.152.209" dst_port="53"/>
        </slice>
        <from usec="0" sec="1299128860"/>
        <to usec="0" sec="1299129221"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="206.175.14.164" dst_ip="186.172.173.31" src_port="80"/>
        </slice>
        <from usec="0" sec="1299128909"/>
        <to usec="0" sec="1299129227"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="164.6.20.201" dst_ip="220.51.48.210" dst_port="80"/>
        </slice>
        <from usec="0" sec="1299128920"/>
        <to usec="0" sec="1299129227"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,020,0 0 0 1 1 0 0 0 0 0 0 0,sptpDoSIC">
        <slice>
            <filter src_ip="206.175.15.112" dst_ip="78.61.180.69"/>
        </slice>
        <from usec="0" sec="1299128950"/>
        <to usec="0" sec="1299129149"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="164.6.151.237" dst_ip="207.162.203.239" src_port="8000" dst_port="40577"/>
        </slice>
        <from usec="0" sec="1299128982"/>
        <to usec="0" sec="1299129128"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="154.17.4.176" dst_ip="55.4.75.249" src_port="29010" dst_port="20047"/>
            <filter src_ip="136.52.110.117" dst_ip="55.4.75.249" src_port="80" dst_port="25511"/>
        </slice>
        <from usec="0" sec="1299128998"/>
        <to usec="0" sec="1299129126"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.52.61.24" dst_ip="41.250.97.240" dst_port="80"/>
        </slice>
        <from usec="0" sec="1299129072"/>
        <to usec="0" sec="1299129129"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="207.3.98.173" dst_ip="164.6.95.140" src_port="80"/>
            <filter src_ip="207.3.170.153" dst_ip="164.6.95.140" src_port="80"/>
            <filter src_ip="207.43.140.197" dst_ip="164.6.95.140" src_port="80"/>
        </slice>
        <from usec="0" sec="1299129119"/>
        <to usec="0" sec="1299129225"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="196.133.141.64" dst_ip="164.6.32.51" src_port="80"/>
        </slice>
        <from usec="0" sec="1299129137"/>
        <to usec="0" sec="1299129210"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="206.175.9.146" dst_ip="53.49.75.165" src_port="80" dst_port="48096"/>
            <filter src_ip="206.175.9.146" dst_ip="53.49.75.165" src_port="80" dst_port="48095"/>
        </slice>
        <from usec="0" sec="1299129175"/>
        <to usec="0" sec="1299129226"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854023,1.248870,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="206.175.2.111" dst_ip="217.56.118.140" src_port="80" dst_port="27619"/>
            <filter src_ip="206.175.2.111" dst_ip="217.56.118.140" src_port="80" dst_port="16486"/>
        </slice>
        <from usec="0" sec="1299129222"/>
        <to usec="0" sec="1299129229"/>
    </anomaly>
    <anomaly type="suspicious" value="1.386660,1.523280,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299129229"/>
    </anomaly>
    <anomaly type="suspicious" value="0.911627,1.220470,999,1 0 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="206.175.7.161"/>
            <filter src_ip="206.175.15.113" src_port="23269"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299129247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.219650,1.323190,999,1 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="166.224.135.143" src_port="53"/>
            <filter dst_ip="166.224.135.143" dst_port="53"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299129167"/>
    </anomaly>
    <anomaly type="suspicious" value="0.983816,1.290460,999,0 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="207.10.63.156" dst_port="53"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299129229"/>
    </anomaly>
    <anomaly type="suspicious" value="0.983816,1.290460,999,0 0 0 1 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="206.175.4.117" dst_ip="206.215.202.132" src_port="123"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299129229"/>
    </anomaly>
    <anomaly type="suspicious" value="0.911627,1.220470,503,1 0 0 1 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="136.52.40.34" dst_port="80"/>
            <filter src_ip="136.52.40.34" dst_port="8612"/>
        </slice>
        <from usec="0" sec="1299128403"/>
        <to usec="0" sec="1299129103"/>
    </anomaly>
    <anomaly type="suspicious" value="0.812257,1.175040,999,0 0 0 1 0 0 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="207.10.214.76"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.983816,1.290460,999,0 0 0 1 0 0 1 1 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="206.175.15.123" dst_ip="200.217.162.131" src_port="3124"/>
            <filter src_ip="206.175.15.123" dst_ip="76.61.59.168" src_port="3124"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299129229"/>
    </anomaly>
    <anomaly type="suspicious" value="0.983816,1.290460,999,0 0 0 1 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.175.15.123"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299129229"/>
    </anomaly>
    <anomaly type="suspicious" value="1.219650,1.323190,999,1 0 0 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="206.175.4.117" src_port="123" dst_port="123"/>
            <filter dst_ip="206.175.4.117" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1299128446"/>
        <to usec="0" sec="1299129222"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="136.52.212.3" dst_ip="206.215.202.132" src_port="123"/>
            <filter src_ip="136.52.212.3" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1299128806"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="0.983816,1.290460,020,0 0 0 1 0 0 1 1 0 0 0 0,ntscICecrqICecrqdurmterp">
        <slice>
            <filter dst_ip="211.59.183.83"/>
        </slice>
        <from usec="0" sec="1299128720"/>
        <to usec="0" sec="1299129229"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="166.224.135.142" src_port="53"/>
            <filter dst_ip="166.224.135.142" dst_port="53"/>
        </slice>
        <from usec="0" sec="1299128806"/>
        <to usec="0" sec="1299129167"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.175.7.178" dst_port="45552"/>
        </slice>
        <from usec="0" sec="1299128806"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.195700,1.311300,503,1 0 0 1 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.175.14.159" dst_port="80"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299129139"/>
    </anomaly>
    <anomaly type="suspicious" value="1.219650,1.323190,503,1 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="186.253.17.175" dst_ip="206.175.14.156" dst_port="80"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299129259"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="166.224.164.28" dst_port="27411"/>
        </slice>
        <from usec="0" sec="1299128716"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.147280,1.281410,503,0 0 0 0 0 0 1 1 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.175.14.148" src_port="53"/>
            <filter dst_ip="206.175.14.148" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="207.10.214.151" dst_port="53"/>
            <filter dst_ip="52.38.225.94" dst_port="53"/>
            <filter dst_ip="48.216.226.217" dst_port="53"/>
        </slice>
        <from usec="0" sec="1299128806"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="166.224.135.142" dst_port="53"/>
        </slice>
        <from usec="0" sec="1299128806"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="206.175.15.123" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299128852"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.175.7.161"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="166.224.135.143" src_port="53"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299128447"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="166.224.135.142" src_port="53"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299128447"/>
    </anomaly>
    <anomaly type="suspicious" value="1.219650,1.323190,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.175.4.117" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1299128401"/>
        <to usec="0" sec="1299128909"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="142.139.9.34" src_port="53"/>
            <filter dst_ip="142.139.9.34" dst_port="53"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="136.52.33.217" src_port="53"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="207.10.214.151" src_port="53"/>
            <filter dst_ip="207.10.214.151" dst_port="53"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,503,0 0 0 0 0 0 1 1 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="78.178.156.142" dst_ip="164.6.236.8" dst_port="80"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="164.6.236.2" dst_port="80"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,rflatDNS">
        <slice>
            <filter dst_ip="207.2.24.198" src_port="53"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.175.3.106" dst_port="53"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="164.6.23.67" dst_port="18751"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.175.14.158" dst_port="80"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.175.14.157" dst_port="80"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="206.175.6.97" dst_ip="77.188.200.168" dst_port="53"/>
            <filter src_ip="207.10.63.156" dst_ip="77.188.200.168" dst_port="53"/>
            <filter src_ip="206.175.3.113" dst_ip="77.188.200.168" dst_port="53"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="142.22.166.247" dst_port="60290"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="142.22.29.84" src_port="53"/>
            <filter dst_ip="142.22.29.84" dst_port="53"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,010,0 0 0 0 0 0 1 1 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="136.52.81.167" dst_port="443"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="164.6.196.110" dst_port="13716"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,020,0 0 0 0 0 0 1 1 0 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="206.175.3.146"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="206.175.3.113" dst_ip="53.81.86.131" dst_port="53"/>
            <filter src_ip="206.175.6.97" dst_ip="53.81.86.131" dst_port="53"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.012790,1.302540,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="136.52.245.1" src_port="53"/>
        </slice>
        <from usec="0" sec="1299128851"/>
        <to usec="0" sec="1299128897"/>
    </anomaly>
    <anomaly type="suspicious" value="0.812257,1.175040,503,0 0 0 1 0 0 1 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="206.175.12.114" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.031610,1.251440,503,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="164.6.151.22" src_port="80"/>
            <filter dst_ip="164.6.151.22" src_port="443"/>
            <filter dst_ip="164.6.72.240" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="136.52.208.200" src_port="80"/>
            <filter dst_ip="136.52.31.126" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.031610,1.251440,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="206.175.14.158" dst_ip="213.26.208.76" src_port="80" dst_port="56562"/>
            <filter src_ip="206.175.14.158" dst_ip="213.26.208.76" src_port="80" dst_port="56533"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.978452,1.210290,503,1 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="136.52.75.228" dst_ip="14.71.36.178" dst_port="80"/>
            <filter src_ip="164.6.20.201" dst_ip="14.71.36.178" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="168.255.248.40" dst_ip="164.6.22.39" src_port="80"/>
            <filter src_ip="168.255.248.42" dst_ip="164.6.22.39" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.031610,1.251440,503,0 0 0 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="207.10.57.62" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="206.254.226.62" dst_ip="164.6.89.24" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="219.11.34.218" dst_ip="136.52.119.16" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="12.191.166.20" dst_ip="207.2.16.26" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879612,1.273080,999,0 0 0 1 0 0 0 0 0 0 1 0,salphfl">
        <slice>
            <filter src_ip="12.185.222.178" dst_ip="207.2.63.209" src_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="17.89.80.0" dst_ip="142.190.36.92" src_port="80" dst_port="50753"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="211.171.83.112" dst_ip="136.52.48.14" src_port="80"/>
            <filter src_ip="218.129.57.20" dst_ip="136.52.48.14" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="213.124.113.22" dst_ip="136.52.100.20" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="142.190.73.135" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="78.5.112.210" dst_ip="164.6.118.6" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="164.6.162.228" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="142.0.179.143" dst_ip="219.184.163.85" src_port="80"/>
            <filter src_ip="154.17.27.15" dst_ip="219.184.163.85" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="154.17.211.72" dst_ip="219.184.163.136" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="136.52.46.241" dst_ip="3.125.233.51" src_port="1043" dst_port="443"/>
            <filter src_ip="136.52.46.241" dst_ip="3.125.233.51" src_port="1042" dst_port="443"/>
            <filter src_ip="136.52.46.241" dst_ip="3.125.233.51" src_port="1041" dst_port="80"/>
            <filter src_ip="136.52.46.241" dst_ip="196.33.77.216" src_port="1049" dst_port="80"/>
            <filter src_ip="136.52.46.241" dst_ip="3.124.215.39" src_port="1045" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="136.52.152.113" dst_ip="3.124.215.9" dst_port="80"/>
            <filter src_ip="136.52.148.51" dst_ip="3.124.215.9" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="0.8.195.83" src_port="53"/>
            <filter src_ip="142.0.180.26" dst_ip="0.8.195.83" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="136.52.88.20" dst_ip="1.48.117.26"/>
            <filter src_ip="136.52.88.20" src_port="80"/>
            <filter dst_ip="1.48.117.26" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059280,1.263900,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="207.2.16.26" dst_ip="12.191.166.20" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
