<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.518810,1.345320,503,1 1 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="196.232.253.90" dst_ip="217.178.97.105"/>
            <filter dst_ip="217.178.97.105" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.314220,1.240510,503,1 1 0 0 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="196.232.253.209" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.589510,2.327170,011,1 1 1 0 0 0 1 1 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="54.89.186.30" src_port="1433" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1312779735"/>
        <to usec="0" sec="1312779781"/>
    </anomaly>
    <anomaly type="anomalous" value="2.088090,1.501470,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="196.232.243.130" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.962200,1.459660,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="174.1.109.68" dst_ip="217.178.97.24" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.723080,1.451110,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="5.184.48.164" dst_ip="131.41.218.229" src_port="80"/>
            <filter src_ip="5.184.48.140" dst_ip="131.41.218.229" src_port="80"/>
        </slice>
        <from usec="0" sec="1312779687"/>
        <to usec="0" sec="1312780428"/>
    </anomaly>
    <anomaly type="anomalous" value="2.233870,1.557910,503,1 1 0 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="196.232.243.130" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.962200,1.459660,503,0 0 0 1 1 1 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="131.41.98.157" dst_ip="12.69.128.185" src_port="80"/>
            <filter src_ip="186.144.16.179" dst_ip="12.69.128.185" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.813610,1.382270,503,0 0 0 1 1 1 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="168.40.130.136" dst_ip="217.178.97.25" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.962200,1.459660,503,0 0 0 1 1 1 0 0 0 1 1 1,malphfl">
        <slice>
            <filter src_ip="186.144.168.88" dst_ip="217.178.97.4" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.157180,2.451420,011,1 1 1 1 1 1 1 1 1 1 1 0,DDoSRSTrp">
        <slice>
            <filter src_ip="197.15.165.30"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.353350,1.328950,504,1 1 0 0 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="174.1.107.167" dst_port="80"/>
            <filter src_ip="174.1.107.167" dst_port="443"/>
            <filter dst_ip="72.189.33.65" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.638550,1.385910,999,1 1 0 0 0 0 1 1 1 1 1 1,ptpposcaUDP">
        <slice>
            <filter src_ip="131.41.37.181" dst_ip="136.200.217.100"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.157180,2.451420,010,1 1 1 1 1 1 1 1 1 1 1 0,DDoSSYN">
        <slice>
            <filter dst_ip="197.15.165.30"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.813610,1.382270,503,0 0 0 1 1 1 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="131.41.130.57" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.797870,1.401250,503,1 1 0 1 0 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="196.232.243.165" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.314220,1.240510,503,1 1 0 0 0 0 1 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="174.1.134.67" dst_ip="60.195.176.32" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.634400,1.320440,999,1 1 0 1 0 0 1 1 1 1 1 0,ipv46tun">
        <slice>
            <filter src_ip="201.159.54.28"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.485140,1.276290,999,1 0 0 1 0 0 0 0 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="131.41.37.181" dst_port="16001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.957470,1.442060,504,0 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter src_ip="174.1.216.94" dst_port="80"/>
            <filter dst_ip="217.178.106.126" dst_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.962200,1.459660,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="186.144.29.171" dst_ip="217.178.97.152" src_port="80" dst_port="64422"/>
            <filter src_ip="186.144.29.171" dst_ip="12.69.133.184" src_port="80" dst_port="55310"/>
            <filter src_ip="186.144.29.171" dst_ip="12.69.133.184" src_port="80" dst_port="38779"/>
            <filter src_ip="186.144.10.234" dst_ip="217.178.97.152" src_port="80" dst_port="38420"/>
            <filter src_ip="168.40.20.61" dst_ip="217.178.97.152" src_port="80" dst_port="37881"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.957470,1.442060,503,0 0 0 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="197.0.24.4" src_port="80"/>
            <filter dst_ip="197.0.24.4" src_port="53"/>
            <filter dst_ip="197.0.24.4" dst_port="46242"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.302210,1.226830,503,0 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="196.232.243.165" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.962200,1.459660,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="57.198.134.173" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.881451,1.249510,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="197.0.42.213" dst_ip="205.107.31.47" src_port="64965" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1312779639"/>
        <to usec="0" sec="1312780003"/>
    </anomaly>
    <anomaly type="suspicious" value="0.881451,1.249510,503,1 0 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="174.1.99.213" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1312780408"/>
        <to usec="0" sec="1312780410"/>
    </anomaly>
    <anomaly type="suspicious" value="0.881451,1.249510,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="197.15.165.24" dst_ip="197.15.165.24" proto="tcp"/>
        </slice>
        <from usec="0" sec="1312779620"/>
        <to usec="0" sec="1312780501"/>
    </anomaly>
    <anomaly type="suspicious" value="1.205610,1.286570,503,1 1 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="168.45.109.89" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.205610,1.286570,503,1 1 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="131.41.130.57" dst_ip="217.119.165.157" dst_port="80"/>
            <filter src_ip="131.41.130.57" dst_ip="136.197.110.15" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.193970,1.336050,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="174.1.128.147" dst_ip="196.41.41.247" dst_port="80"/>
        </slice>
        <from usec="0" sec="1312779645"/>
        <to usec="0" sec="1312779937"/>
    </anomaly>
    <anomaly type="suspicious" value="0.956913,1.288880,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="197.15.165.24" dst_ip="197.15.165.24" proto="tcp"/>
        </slice>
        <from usec="0" sec="1312779908"/>
        <to usec="0" sec="1312780500"/>
    </anomaly>
    <anomaly type="suspicious" value="1.193970,1.336050,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="49.194.172.20" dst_port="445"/>
            <filter src_ip="49.194.172.20" dst_port="139"/>
        </slice>
        <from usec="0" sec="1312780156"/>
        <to usec="0" sec="1312780200"/>
    </anomaly>
    <anomaly type="suspicious" value="1.193970,1.336050,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="6.50.19.84" dst_port="139"/>
        </slice>
        <from usec="0" sec="1312780469"/>
        <to usec="0" sec="1312780494"/>
    </anomaly>
    <anomaly type="suspicious" value="1.193970,1.336050,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="20.205.22.117" dst_port="445"/>
            <filter src_ip="20.205.22.117" dst_port="139"/>
        </slice>
        <from usec="0" sec="1312779876"/>
        <to usec="0" sec="1312779918"/>
    </anomaly>
    <anomaly type="suspicious" value="1.193970,1.336050,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="26.102.76.124" dst_port="139"/>
        </slice>
        <from usec="0" sec="1312779981"/>
        <to usec="0" sec="1312779991"/>
    </anomaly>
    <anomaly type="suspicious" value="1.193970,1.336050,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="26.102.76.124"/>
        </slice>
        <from usec="0" sec="1312779981"/>
        <to usec="0" sec="1312779991"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902521,1.216650,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="12.69.133.32"/>
        </slice>
        <from usec="0" sec="1312779601"/>
        <to usec="0" sec="1312779707"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902521,1.216650,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="13.214.133.73"/>
        </slice>
        <from usec="0" sec="1312779620"/>
        <to usec="0" sec="1312779839"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902521,1.216650,504,0 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="131.41.131.217"/>
        </slice>
        <from usec="0" sec="1312779600"/>
        <to usec="0" sec="1312780158"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990165,1.157910,999,0 0 0 1 0 0 1 1 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="196.232.62.20" src_port="50194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.104780,1.208850,503,0 0 0 1 0 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="219.27.122.190" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.092070,1.261380,999,0 0 0 1 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="197.190.20.82" dst_ip="10.64.17.12" src_port="53"/>
        </slice>
        <from usec="0" sec="1312779600"/>
        <to usec="0" sec="1312779708"/>
    </anomaly>
    <anomaly type="suspicious" value="0.820411,1.191030,503,0 0 0 0 0 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="174.1.26.107" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.820411,1.191030,999,0 0 0 0 0 0 1 1 1 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="168.55.115.155" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.820411,1.191030,010,0 0 0 0 0 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="136.239.70.88" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.261530,1.282780,010,1 1 0 0 0 0 1 1 0 1 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="196.232.242.81"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.092070,1.261380,010,0 0 0 1 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="197.15.165.24"/>
        </slice>
        <from usec="0" sec="1312779600"/>
        <to usec="0" sec="1312780321"/>
    </anomaly>
    <anomaly type="suspicious" value="0.982503,1.163290,503,0 0 0 0 0 0 1 1 1 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="197.0.24.4" src_port="46242"/>
            <filter src_ip="197.0.24.4" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.820411,1.191030,010,0 0 0 0 0 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="84.140.82.84" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.261530,1.282780,010,1 1 0 0 0 0 1 1 0 1 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="196.232.249.105"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.071580,1.209280,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="216.164.98.133" dst_ip="174.1.163.128" src_port="80"/>
            <filter src_ip="216.164.98.152" dst_ip="174.1.163.128" src_port="80"/>
            <filter src_ip="197.140.200.82" dst_ip="174.1.163.128" src_port="80"/>
            <filter src_ip="194.172.21.104" dst_ip="174.1.163.128" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.820411,1.191030,999,0 0 0 0 0 0 1 1 1 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="196.232.242.89" src_port="23269"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.047440,1.168850,503,1 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="197.0.42.213" src_port="80"/>
            <filter dst_ip="197.0.42.213" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.917863,1.162100,503,0 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="131.41.98.145" src_port="80"/>
            <filter dst_ip="217.178.97.26" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.071580,1.209280,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="175.75.132.24" dst_ip="12.69.137.248" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.071580,1.209280,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="174.1.136.102" dst_ip="103.102.199.139"/>
            <filter src_ip="174.1.136.102" dst_ip="103.112.53.146" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766315,1.114630,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="174.1.201.70" dst_port="53"/>
            <filter src_ip="174.1.201.70" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.071580,1.209280,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="174.1.160.153"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766315,1.114630,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="168.40.88.143" dst_ip="12.69.128.5" src_port="80"/>
            <filter src_ip="168.40.88.143" dst_ip="217.178.97.80" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766315,1.114630,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="186.144.89.73" dst_ip="217.178.97.169"/>
            <filter src_ip="186.144.89.73" src_port="21"/>
            <filter dst_ip="217.178.97.169" src_port="21"/>
            <filter src_ip="186.144.89.73" dst_ip="12.69.128.28" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.071580,1.209280,502,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="196.232.252.116" dst_ip="201.207.51.5" src_port="53"/>
            <filter src_ip="196.232.255.44" dst_ip="201.207.51.5" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.071580,1.209280,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="81.94.214.221" dst_ip="174.1.99.245" src_port="80"/>
            <filter src_ip="81.94.214.221" dst_ip="174.1.99.246" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.071580,1.209280,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="174.1.82.70" dst_ip="48.33.154.116" src_port="80" dst_port="50065"/>
            <filter src_ip="174.1.82.70" dst_ip="48.33.154.116" src_port="80" dst_port="50064"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766315,1.114630,503,0 0 0 0 0 0 0 0 0 1 1 0,heavy_hitter">
        <slice>
            <filter src_ip="168.55.224.153" dst_ip="161.126.69.150" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.062890,1.187970,503,0 0 0 0 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="196.232.240.4" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766315,1.114630,503,0 0 0 0 0 0 0 0 0 1 1 0,point_to_point">
        <slice>
            <filter src_ip="13.214.7.166" dst_ip="131.41.128.173" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766315,1.114630,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="196.232.62.20" dst_ip="139.194.87.100" src_port="50194" dst_port="62073"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.071580,1.209280,999,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="201.207.51.5" dst_ip="196.232.254.146" src_port="53095" dst_port="34253"/>
            <filter src_ip="201.207.51.5" dst_ip="196.232.254.146" src_port="12865" dst_port="59086"/>
            <filter src_ip="86.44.103.84" dst_ip="196.232.254.146" src_port="45646" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.071580,1.209280,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="131.41.130.57" dst_ip="217.119.187.169" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766315,1.114630,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="131.41.98.174" dst_ip="217.178.97.6" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.071580,1.209280,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="186.144.89.2" dst_ip="217.178.97.162"/>
            <filter dst_ip="217.178.97.162" src_port="80"/>
            <filter src_ip="186.144.89.2" dst_ip="12.69.133.65" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766315,1.114630,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="168.40.24.246" dst_ip="12.69.128.229" src_port="80"/>
            <filter src_ip="196.232.253.6" dst_ip="12.69.128.229" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766315,1.114630,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="174.1.0.10" dst_ip="2.50.183.9" src_port="7794" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
