<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.024080,1.425070,503,1 1 0 1 0 0 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="199.48.6.251" dst_port="443"/>
            <filter src_ip="199.48.6.251" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.024080,1.425070,503,1 1 0 1 0 0 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="199.48.6.251" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.000210,1.876410,020,1 1 1 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="213.155.195.151"/>
        </slice>
        <from usec="0" sec="1310014890"/>
        <to usec="0" sec="1310015509"/>
    </anomaly>
    <anomaly type="anomalous" value="2.070960,1.858090,010,1 1 1 1 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="9.187.180.121" dst_port="25"/>
        </slice>
        <from usec="0" sec="1310014890"/>
        <to usec="0" sec="1310014940"/>
    </anomaly>
    <anomaly type="anomalous" value="1.719130,1.430860,010,1 1 0 1 1 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="198.53.184.53"/>
        </slice>
        <from usec="0" sec="1310014800"/>
        <to usec="0" sec="1310015701"/>
    </anomaly>
    <anomaly type="anomalous" value="2.668670,2.084570,011,1 1 1 1 1 1 1 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="155.151.21.57" src_port="8080" dst_port="7643"/>
        </slice>
        <from usec="0" sec="1310014800"/>
        <to usec="0" sec="1310015574"/>
    </anomaly>
    <anomaly type="anomalous" value="2.390940,1.722670,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="216.56.143.202" src_port="80"/>
            <filter src_ip="168.118.137.238" dst_ip="28.206.209.9" src_port="80"/>
            <filter src_ip="168.118.137.238" dst_ip="28.206.212.80" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.457300,1.719460,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="199.56.140.137" src_port="80"/>
            <filter src_ip="59.86.122.13" dst_ip="199.56.140.107" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.395770,1.829180,503,1 1 1 1 0 0 1 1 1 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="199.56.142.1" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.108790,2.121610,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="215.112.40.147" src_port="6000" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.390940,1.722670,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="174.33.80.145" dst_ip="216.56.143.16" src_port="80"/>
            <filter src_ip="174.33.80.145" dst_ip="39.2.110.0" src_port="80"/>
            <filter src_ip="174.33.80.145" dst_ip="28.206.212.40" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.390940,1.722670,999,0 0 0 1 1 1 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="216.193.156.153" dst_ip="198.53.185.148" src_port="873" dst_port="41602"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.948760,1.621240,503,0 0 0 1 1 1 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="149.101.91.199" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.130180,1.449900,503,1 0 0 1 1 0 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="198.53.176.135" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.987140,1.551270,999,0 0 0 1 1 1 1 1 1 1 0 0,ptmp">
        <slice>
            <filter src_ip="198.53.49.36" src_port="50194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.390940,1.722670,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="141.13.35.44" dst_ip="169.34.180.64" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.416180,1.631390,503,1 1 0 1 1 1 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="198.53.185.165" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.830700,1.966950,011,1 1 1 1 1 0 1 1 1 1 1 1,DDoSRSTrp">
        <slice>
            <filter src_ip="199.56.19.52"/>
            <filter src_ip="198.53.184.52"/>
            <filter src_ip="198.53.184.53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.558050,1.917470,503,1 1 1 0 0 0 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="199.48.37.141" dst_port="80"/>
            <filter src_ip="199.48.37.141" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.216460,1.808060,999,1 1 1 1 0 0 1 1 1 1 0 0,ipv46tun">
        <slice>
            <filter src_ip="205.75.154.255"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.487840,1.653650,503,1 0 0 1 1 1 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="198.53.185.165" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.630780,1.899090,010,1 1 1 1 1 0 1 1 1 1 1 0,DDoSSYN">
        <slice>
            <filter dst_ip="199.56.19.52"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.783100,2.040110,010,1 1 1 1 1 1 1 1 1 1 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="198.53.184.52"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.948760,1.621240,503,0 0 0 1 1 1 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="198.53.181.212" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.376470,1.683420,999,0 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="199.56.141.187" src_port="53"/>
            <filter dst_ip="174.130.34.177" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.443220,1.680130,999,1 0 0 1 1 1 1 0 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="149.101.230.81" dst_port="55460"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.108790,2.121610,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="155.151.21.57" src_port="7643" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.632460,1.709910,503,1 1 0 1 1 1 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="198.53.185.148" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.024080,1.425070,999,1 1 0 1 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="19.6.79.10"/>
            <filter src_ip="169.34.180.64" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.951630,1.448870,503,1 1 0 0 0 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="198.53.176.135" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.698130,1.440360,503,0 0 0 1 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="149.101.176.201" dst_ip="87.95.49.196" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.422330,1.656990,503,0 0 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="199.56.142.1" src_port="80"/>
            <filter dst_ip="199.56.141.91" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.832050,1.357060,503,1 0 0 1 0 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="199.48.6.251" src_port="53"/>
            <filter dst_ip="199.48.6.251" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.951630,1.448870,503,1 1 0 0 0 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="198.53.185.148" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.611100,1.463910,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="186.135.21.137" dst_ip="16.150.232.72"/>
            <filter src_ip="186.135.21.137" dst_ip="216.56.143.132" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.611100,1.463910,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="155.149.23.53" dst_ip="149.101.145.145" src_port="80" dst_port="36888"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.611100,1.463910,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="199.48.51.97" src_port="53"/>
            <filter src_ip="19.139.159.130" dst_ip="199.48.51.97" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155470,1.441230,999,1 1 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="198.53.176.89" dst_ip="16.150.241.65" dst_port="25"/>
            <filter src_ip="198.53.181.151" dst_ip="16.150.241.65" dst_port="25"/>
            <filter src_ip="169.34.148.97" dst_ip="16.150.241.65" dst_port="25"/>
        </slice>
        <from usec="0" sec="1310014911"/>
        <to usec="0" sec="1310014940"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155470,1.441230,999,1 1 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="16.150.241.17" dst_ip="174.130.236.215" src_port="993" dst_port="54154"/>
            <filter src_ip="16.150.241.17" dst_ip="174.130.236.215" src_port="993" dst_port="54153"/>
            <filter src_ip="16.150.241.17" dst_ip="174.130.236.215" src_port="993" dst_port="54152"/>
            <filter src_ip="19.6.54.89" dst_ip="174.130.236.215" src_port="993" dst_port="54386"/>
        </slice>
        <from usec="0" sec="1310014800"/>
        <to usec="0" sec="1310015701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155470,1.441230,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="193.104.208.252" dst_ip="198.53.174.51" dst_port="80"/>
        </slice>
        <from usec="0" sec="1310014905"/>
        <to usec="0" sec="1310014920"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155470,1.441230,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="149.101.133.182" dst_ip="217.86.116.40" dst_port="80"/>
        </slice>
        <from usec="0" sec="1310014900"/>
        <to usec="0" sec="1310014935"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155470,1.441230,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="149.101.11.226" src_port="48922"/>
        </slice>
        <from usec="0" sec="1310014800"/>
        <to usec="0" sec="1310015699"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155470,1.441230,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="199.56.142.144" dst_ip="141.44.156.92" src_port="38357" dst_port="443"/>
        </slice>
        <from usec="0" sec="1310015608"/>
        <to usec="0" sec="1310015657"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155470,1.441230,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="86.92.29.59" dst_ip="199.48.37.254" src_port="59805" dst_port="400"/>
            <filter src_ip="86.92.29.59" dst_ip="199.48.37.254" src_port="57735" dst_port="400"/>
        </slice>
        <from usec="0" sec="1310014900"/>
        <to usec="0" sec="1310014935"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155470,1.441230,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.34.7.174" dst_ip="85.138.8.98" dst_port="80"/>
        </slice>
        <from usec="0" sec="1310014900"/>
        <to usec="0" sec="1310014905"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155470,1.441230,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.235.37.22" dst_ip="149.101.230.81" src_port="80"/>
        </slice>
        <from usec="0" sec="1310015465"/>
        <to usec="0" sec="1310015469"/>
    </anomaly>
    <anomaly type="suspicious" value="1.006680,1.445060,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="199.48.37.141" dst_ip="199.48.37.141" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1310015011"/>
        <to usec="0" sec="1310015021"/>
    </anomaly>
    <anomaly type="suspicious" value="1.198960,1.225730,503,1 0 0 1 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="169.34.97.230" dst_port="80"/>
            <filter src_ip="169.34.97.230" dst_port="443"/>
            <filter src_ip="169.34.97.230" dst_port="53"/>
            <filter src_ip="169.34.129.144" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.307540,1.399040,503,1 1 0 1 0 0 0 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="199.56.19.48" src_port="80"/>
        </slice>
        <from usec="0" sec="1310014800"/>
        <to usec="0" sec="1310015682"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155470,1.441230,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="216.56.143.2" dst_ip="149.101.27.24" src_port="56250" dst_port="80"/>
            <filter src_ip="216.56.143.2" dst_ip="149.101.176.200" src_port="42031" dst_port="80"/>
        </slice>
        <from usec="0" sec="1310014901"/>
        <to usec="0" sec="1310014912"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155470,1.441230,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="21.236.172.252" dst_port="445"/>
        </slice>
        <from usec="0" sec="1310015063"/>
        <to usec="0" sec="1310015079"/>
    </anomaly>
    <anomaly type="suspicious" value="1.125210,1.394080,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="0.228.209.40" dst_port="445"/>
            <filter src_ip="0.228.209.40" dst_port="139"/>
        </slice>
        <from usec="0" sec="1310014888"/>
        <to usec="0" sec="1310014936"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155470,1.441230,999,1 1 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="199.56.1.19" dst_ip="85.174.155.228" src_port="56607" dst_port="82"/>
            <filter src_ip="199.56.1.19" dst_ip="85.174.155.228" src_port="56606" dst_port="82"/>
            <filter src_ip="199.56.141.91" dst_ip="85.174.155.228" src_port="32196" dst_port="82"/>
        </slice>
        <from usec="0" sec="1310014900"/>
        <to usec="0" sec="1310014902"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155470,1.441230,504,1 1 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="174.50.138.102" dst_ip="2.16.94.111" src_port="53114" dst_port="443"/>
            <filter src_ip="174.50.138.102" dst_ip="2.16.94.111" src_port="51426" dst_port="7967"/>
            <filter src_ip="174.50.139.134" dst_ip="2.16.94.111" src_port="50254" dst_port="443"/>
        </slice>
        <from usec="0" sec="1310014896"/>
        <to usec="0" sec="1310014925"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155470,1.441230,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="0.228.209.40"/>
        </slice>
        <from usec="0" sec="1310014891"/>
        <to usec="0" sec="1310014892"/>
    </anomaly>
    <anomaly type="suspicious" value="1.319920,1.446090,503,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="174.50.2.129" dst_ip="19.6.82.5" dst_port="80"/>
        </slice>
        <from usec="0" sec="1310014800"/>
        <to usec="0" sec="1310015178"/>
    </anomaly>
    <anomaly type="suspicious" value="1.319920,1.446090,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="174.50.139.87" dst_ip="107.131.35.56" dst_port="443"/>
            <filter src_ip="174.50.139.81" dst_ip="107.131.35.56" dst_port="80"/>
        </slice>
        <from usec="0" sec="1310014820"/>
        <to usec="0" sec="1310015141"/>
    </anomaly>
    <anomaly type="suspicious" value="1.319920,1.446090,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="174.50.170.167" dst_ip="153.160.246.237" src_port="1049" dst_port="2112"/>
            <filter src_ip="174.50.170.167" dst_ip="153.160.246.237" src_port="1046" dst_port="2112"/>
            <filter src_ip="169.34.167.89" dst_ip="153.160.246.237" src_port="1054" dst_port="2112"/>
        </slice>
        <from usec="0" sec="1310014801"/>
        <to usec="0" sec="1310015627"/>
    </anomaly>
    <anomaly type="suspicious" value="0.909831,1.257730,999,0 0 0 0 0 0 1 1 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="199.56.27.101" dst_port="24498"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.219080,1.362050,504,1 1 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="198.53.185.132"/>
            <filter dst_ip="203.57.189.206" dst_port="80"/>
            <filter dst_ip="203.57.188.72" dst_port="80"/>
        </slice>
        <from usec="0" sec="1310014905"/>
        <to usec="0" sec="1310015656"/>
    </anomaly>
    <anomaly type="suspicious" value="1.056310,1.230230,999,0 0 0 1 0 0 1 1 1 1 0 0,ptmp">
        <slice>
            <filter src_ip="169.34.69.177" src_port="45682"/>
            <filter src_ip="169.34.69.177" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.909831,1.257730,503,0 0 0 0 0 0 1 1 1 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="198.53.180.92" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.863540,1.290720,999,1 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="198.53.186.89" dst_port="80"/>
            <filter dst_ip="30.11.186.241" dst_port="3544"/>
        </slice>
        <from usec="0" sec="1310014800"/>
        <to usec="0" sec="1310015071"/>
    </anomaly>
    <anomaly type="suspicious" value="1.318670,1.407840,999,1 1 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="174.130.236.215" dst_port="993"/>
            <filter src_ip="174.130.236.215" dst_ip="203.57.189.206" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.909831,1.257730,011,0 0 0 0 0 0 1 1 1 1 0 0,ptmp">
        <slice>
            <filter src_ip="61.64.112.8"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.999215,1.338960,504,1 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="169.34.88.136" dst_ip="155.158.208.27" src_port="47265" dst_port="443"/>
            <filter src_ip="174.50.226.162" dst_ip="155.158.208.27" src_port="63737" dst_port="443"/>
            <filter src_ip="169.34.35.36" dst_ip="155.158.208.27" src_port="11915" dst_port="443"/>
            <filter src_ip="198.53.186.89" dst_ip="155.158.208.27" src_port="50779" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.056310,1.230230,502,0 0 0 1 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="84.171.91.136" dst_ip="199.56.137.112"/>
            <filter src_ip="84.171.91.136" dst_port="22"/>
            <filter src_ip="61.67.92.178" dst_ip="199.56.137.112"/>
            <filter src_ip="61.67.92.178" dst_port="22"/>
            <filter dst_ip="199.56.137.112" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.999215,1.338960,503,1 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.49.25.154" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.909831,1.257730,503,0 0 0 0 0 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="174.50.161.83" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.226270,1.371380,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="51.84.164.105" dst_ip="149.101.65.209" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.226270,1.371380,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="154.40.245.12" dst_ip="149.101.11.162" src_port="4332" dst_port="15915"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.226270,1.371380,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="141.13.85.129" dst_ip="199.48.37.141" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.226270,1.371380,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="84.125.103.145" dst_ip="169.34.176.0" src_port="80" dst_port="62381"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.329900,1.437430,503,0 0 0 0 0 0 0 0 0 1 0 1,alphflHTTP">
        <slice>
            <filter src_ip="9.121.81.111" dst_ip="169.34.156.180" src_port="80" dst_port="40323"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.226270,1.371380,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="149.101.41.190" dst_ip="48.139.250.226" src_port="80"/>
            <filter src_ip="149.101.41.87" dst_ip="48.139.250.226" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.329900,1.437430,503,0 0 0 0 0 0 0 0 0 1 0 1,mptpHTTP">
        <slice>
            <filter dst_ip="149.101.133.25" src_port="80"/>
            <filter dst_ip="149.101.133.25" dst_port="63150"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.048790,1.405630,503,0 0 0 0 0 0 0 0 0 0 1 0,alphflHTTP">
        <slice>
            <filter src_ip="9.121.81.111" dst_ip="169.34.156.180" src_port="80" dst_port="40323"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.048790,1.405630,503,0 0 0 0 0 0 0 0 0 0 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="149.101.133.25" src_port="80"/>
            <filter dst_ip="149.101.133.25" dst_port="63150"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
