<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.827240,2.020990,999,1 1 1 1 1 1 1 1 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="200.139.42.223" src_port="50178"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.990480,2.054260,010,1 1 1 1 1 1 1 1 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="95.12.77.131" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.603490,1.804860,011,1 1 1 1 1 1 0 0 0 1 1 0,ntscTCPRSTrp">
        <slice>
            <filter dst_ip="98.230.113.76" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.201080,1.481640,503,1 1 0 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="200.139.179.128" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.856000,1.654460,010,1 1 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.64.6.46" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1304571600"/>
        <to usec="0" sec="1304571646"/>
    </anomaly>
    <anomaly type="anomalous" value="2.078500,1.599370,011,1 1 0 1 1 0 1 1 0 1 0 0,DDoSRSTrp">
        <slice>
            <filter src_ip="200.139.178.43"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.436310,1.383750,010,1 1 0 1 0 0 1 0 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="200.139.178.43"/>
        </slice>
        <from usec="0" sec="1304571600"/>
        <to usec="0" sec="1304572444"/>
    </anomaly>
    <anomaly type="anomalous" value="1.754060,1.352010,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="187.37.189.3" src_port="80"/>
            <filter src_ip="164.69.13.2" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.521030,1.298040,503,0 0 0 0 1 1 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="187.37.238.223" dst_ip="208.195.93.251" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.981310,1.535230,010,0 0 0 1 1 1 1 1 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="220.174.86.160" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.527530,1.296860,999,0 0 0 0 1 1 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="124.11.135.197" dst_port="993"/>
            <filter src_ip="164.94.5.148" dst_ip="195.182.205.165" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.458430,1.300920,503,0 0 0 1 1 1 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="187.37.184.4" dst_ip="208.195.93.238" src_port="21"/>
            <filter src_ip="162.90.211.244" dst_ip="208.195.93.238" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.754060,1.352010,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="208.195.93.248" src_port="80"/>
            <filter src_ip="187.37.239.119" dst_ip="117.44.1.120" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.754060,1.352010,504,0 0 0 1 1 1 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="162.90.216.162" dst_ip="90.18.233.110" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.670650,1.999490,010,1 1 1 0 0 0 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="12.200.171.97" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.730560,1.863110,011,1 1 1 1 1 1 1 0 0 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="220.117.160.63" src_port="1433" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.437680,1.214110,503,1 0 0 1 1 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="19.210.43.128" dst_ip="149.2.9.73" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.437680,1.214110,999,1 0 0 1 1 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="14.252.35.198" dst_ip="201.81.126.110" src_port="59805" dst_port="400"/>
            <filter src_ip="14.252.35.198" dst_ip="201.81.126.110" src_port="57735" dst_port="400"/>
            <filter src_ip="14.252.35.156" dst_ip="201.81.126.110" src_port="61517" dst_port="400"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.555240,1.269340,999,0 0 0 1 1 1 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="200.139.189.179"/>
            <filter src_ip="124.11.135.197" src_port="995"/>
            <filter src_ip="124.11.135.197" src_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.726920,1.863930,010,1 1 1 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="98.230.113.76" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.878370,2.000810,503,1 1 1 1 1 1 1 1 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="200.139.179.128" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.754060,1.352010,053,0 0 0 1 1 1 0 0 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="200.139.187.253" dst_ip="208.59.200.117" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.754060,1.352010,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="164.94.4.46" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535060,1.326490,503,1 1 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="162.90.165.172" dst_ip="116.188.232.172" src_port="80"/>
            <filter src_ip="162.90.165.172" dst_ip="200.169.181.74" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.696530,1.509290,010,0 0 0 1 0 0 1 1 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="220.174.86.160" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.920667,1.355680,011,0 0 0 0 0 0 0 0 0 0 0 1,ntscTCPRSTrp">
        <slice>
            <filter dst_ip="98.230.113.76" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.948562,1.317000,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="162.90.133.222" dst_ip="119.177.129.223" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1304571847"/>
        <to usec="0" sec="1304571849"/>
    </anomaly>
    <anomaly type="suspicious" value="0.948562,1.317000,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="164.69.150.106" dst_ip="121.102.232.234" src_port="80" dst_port="60791" proto="tcp"/>
        </slice>
        <from usec="0" sec="1304572343"/>
        <to usec="0" sec="1304572373"/>
    </anomaly>
    <anomaly type="suspicious" value="0.948562,1.317000,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="149.2.16.177"/>
        </slice>
        <from usec="0" sec="1304572481"/>
        <to usec="0" sec="1304572483"/>
    </anomaly>
    <anomaly type="suspicious" value="1.392090,1.411210,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="164.94.169.206" dst_ip="92.2.10.165" src_port="80" dst_port="54382"/>
        </slice>
        <from usec="0" sec="1304572362"/>
        <to usec="0" sec="1304572363"/>
    </anomaly>
    <anomaly type="suspicious" value="1.392090,1.411210,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="111.112.186.120" dst_port="139"/>
        </slice>
        <from usec="0" sec="1304572481"/>
        <to usec="0" sec="1304572498"/>
    </anomaly>
    <anomaly type="suspicious" value="1.392090,1.411210,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="133.9.130.9" dst_port="445"/>
            <filter src_ip="133.9.130.9" dst_port="139"/>
        </slice>
        <from usec="0" sec="1304571670"/>
        <to usec="0" sec="1304571709"/>
    </anomaly>
    <anomaly type="suspicious" value="1.392090,1.411210,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="203.74.154.19" dst_port="445"/>
        </slice>
        <from usec="0" sec="1304572471"/>
        <to usec="0" sec="1304572492"/>
    </anomaly>
    <anomaly type="suspicious" value="1.392090,1.411210,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="141.35.190.18" dst_port="445"/>
            <filter src_ip="141.35.190.18" dst_port="139"/>
        </slice>
        <from usec="0" sec="1304571623"/>
        <to usec="0" sec="1304571636"/>
    </anomaly>
    <anomaly type="suspicious" value="1.156760,1.224530,999,1 0 0 0 0 0 1 0 0 1 1 0,ntscUDP">
        <slice>
            <filter src_ip="200.139.178.32" src_port="23269"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.968684,1.262010,503,0 0 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.28.125.224" dst_port="80"/>
        </slice>
        <from usec="0" sec="1304571601"/>
        <to usec="0" sec="1304571973"/>
    </anomaly>
    <anomaly type="suspicious" value="0.968684,1.262010,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="149.2.118.71" dst_ip="201.80.43.247" dst_port="80"/>
            <filter src_ip="149.2.119.101" dst_ip="201.80.43.247" dst_port="80"/>
            <filter src_ip="162.90.161.51" dst_ip="201.80.43.247" dst_port="80"/>
        </slice>
        <from usec="0" sec="1304571711"/>
        <to usec="0" sec="1304571967"/>
    </anomaly>
    <anomaly type="suspicious" value="0.968684,1.262010,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="149.2.13.47" dst_ip="110.175.17.20" dst_port="80"/>
        </slice>
        <from usec="0" sec="1304571785"/>
        <to usec="0" sec="1304571873"/>
    </anomaly>
    <anomaly type="suspicious" value="0.968684,1.262010,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="149.2.119.125" dst_ip="124.95.77.232" dst_port="80"/>
        </slice>
        <from usec="0" sec="1304571607"/>
        <to usec="0" sec="1304571821"/>
    </anomaly>
    <anomaly type="suspicious" value="0.968684,1.262010,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="200.42.227.141" dst_ip="162.90.218.56" src_port="80" dst_port="52354"/>
            <filter src_ip="200.42.227.141" dst_ip="162.90.218.56" src_port="80" dst_port="52353"/>
            <filter src_ip="112.17.38.254" dst_ip="162.90.218.56" src_port="80" dst_port="52285"/>
        </slice>
        <from usec="0" sec="1304571600"/>
        <to usec="0" sec="1304572064"/>
    </anomaly>
    <anomaly type="suspicious" value="1.171050,1.237830,503,0 0 0 1 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="187.37.238.223" dst_ip="117.44.1.224" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.792475,1.177340,999,0 0 0 0 0 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="201.90.132.238"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.302510,1.538460,999,0 0 0 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="164.94.93.64" src_port="53"/>
            <filter src_ip="200.139.179.172" src_port="53"/>
            <filter dst_ip="200.139.179.172" dst_port="53"/>
            <filter src_port="53" dst_port="53"/>
        </slice>
        <from usec="0" sec="1304571600"/>
        <to usec="0" sec="1304572501"/>
    </anomaly>
    <anomaly type="suspicious" value="1.388710,1.463690,999,0 0 0 1 0 0 1 1 0 1 0 0,ipv46tun">
        <slice>
            <filter src_ip="197.210.120.178"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958959,1.315840,503,1 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="201.90.132.233" src_port="80"/>
        </slice>
        <from usec="0" sec="1304571616"/>
        <to usec="0" sec="1304572482"/>
    </anomaly>
    <anomaly type="suspicious" value="1.342300,1.514330,999,0 0 0 1 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="201.177.150.178" dst_ip="10.64.17.12" src_port="53"/>
        </slice>
        <from usec="0" sec="1304571600"/>
        <to usec="0" sec="1304572366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.302510,1.538460,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="113.41.126.135" src_port="80"/>
        </slice>
        <from usec="0" sec="1304572320"/>
        <to usec="0" sec="1304572411"/>
    </anomaly>
    <anomaly type="suspicious" value="0.844647,1.146960,503,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="162.90.211.245" src_port="80"/>
            <filter src_ip="162.90.211.246" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164840,1.166490,503,0 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="164.69.192.129" dst_ip="208.195.93.250"/>
            <filter src_ip="149.2.190.188" dst_ip="208.195.93.250"/>
            <filter dst_ip="208.195.93.250" src_port="80"/>
            <filter src_ip="164.69.192.129" dst_ip="117.44.5.145" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.125220,1.267240,503,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="201.90.4.13" dst_ip="187.65.223.203" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.792475,1.177340,503,0 0 0 0 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.81.68.251" src_port="53"/>
            <filter dst_ip="201.81.68.251" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.179490,1.236600,503,0 0 0 1 0 0 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="200.139.179.161" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.792475,1.177340,503,0 0 0 0 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.139.179.163" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.134000,1.266040,503,0 0 0 0 0 0 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="200.139.179.163" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.125220,1.267240,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="164.69.47.4" dst_ip="117.44.1.60" src_port="80"/>
            <filter src_ip="200.139.179.180" dst_ip="117.44.1.60" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.125220,1.267240,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="209.52.3.172" dst_ip="149.2.118.58" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.125220,1.267240,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="187.37.184.22" dst_ip="117.44.4.212" src_port="80"/>
            <filter src_ip="187.37.184.22" dst_ip="208.195.93.195" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.164840,1.166490,503,0 0 0 1 1 0 0 0 0 1 1 0,heavy_hitter">
        <slice>
            <filter src_ip="149.2.190.182" dst_ip="15.172.50.44" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.171050,1.237830,999,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="124.11.87.209" dst_port="993"/>
            <filter dst_ip="124.11.87.209" dst_port="995"/>
            <filter dst_ip="124.11.57.200" dst_port="993"/>
            <filter dst_ip="124.11.135.197" dst_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.125220,1.267240,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="162.90.31.31" dst_ip="85.115.156.10" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.125220,1.267240,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="149.2.118.18" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.134000,1.266040,503,0 0 0 0 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="200.139.179.161" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.134000,1.266040,503,0 0 0 0 0 0 1 0 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="208.59.200.117" dst_ip="200.139.187.253" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.844647,1.146960,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="164.69.218.219" dst_ip="117.44.4.146" src_port="80" dst_port="64158"/>
            <filter src_ip="164.69.218.219" dst_ip="117.44.4.146" src_port="80" dst_port="60330"/>
            <filter src_ip="164.69.218.219" dst_ip="117.44.4.146" src_port="80" dst_port="52778"/>
            <filter src_ip="164.69.218.219" dst_ip="117.44.4.146" src_port="80" dst_port="50834"/>
            <filter src_ip="164.69.218.219" dst_ip="117.44.4.146"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.171050,1.237830,999,0 0 0 1 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="187.37.189.9" dst_ip="208.195.93.33"/>
            <filter src_ip="149.2.190.136" dst_ip="208.195.93.33" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.125220,1.267240,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="149.2.118.168" src_port="8156"/>
            <filter src_ip="149.2.118.168" src_port="10421"/>
            <filter src_ip="149.2.118.168" dst_port="17788"/>
            <filter src_port="8156" dst_port="17788"/>
            <filter src_port="10421" dst_port="17788"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
