<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.680920,1.882560,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="212.72.96.86" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.020840,1.775490,010,1 1 1 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="210.243.240.98" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1315544985"/>
        <to usec="0" sec="1315545031"/>
    </anomaly>
    <anomaly type="anomalous" value="2.517380,1.868120,503,1 1 1 1 1 1 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="153.15.212.152" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.012020,1.799770,504,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="180.9.40.70" dst_port="80"/>
            <filter src_ip="180.9.40.70" dst_ip="169.72.254.75" dst_port="443"/>
        </slice>
        <from usec="0" sec="1315545258"/>
        <to usec="0" sec="1315545285"/>
    </anomaly>
    <anomaly type="anomalous" value="2.186950,1.782930,503,1 1 1 0 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="200.104.19.68" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.488810,1.430380,503,1 1 0 0 0 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.104.24.24" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.012020,1.799770,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="77.80.65.22" dst_port="445"/>
            <filter src_ip="77.80.65.22" dst_port="139"/>
        </slice>
        <from usec="0" sec="1315545238"/>
        <to usec="0" sec="1315545286"/>
    </anomaly>
    <anomaly type="anomalous" value="1.813070,1.338440,999,1 0 0 1 1 1 1 1 1 1 0 0,ptmp">
        <slice>
            <filter src_ip="200.104.174.248" src_port="50194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.612520,1.315920,503,0 0 0 1 1 1 0 0 0 1 0 0,salphfl">
        <slice>
            <filter src_ip="197.129.136.98" dst_ip="153.15.212.4" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.818490,1.363230,999,0 0 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="153.15.164.0"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.818490,1.363230,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="153.15.65.3" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.857510,1.336340,503,0 0 0 1 1 1 1 1 1 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="75.26.192.200" dst_ip="178.82.204.243" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.592590,1.848350,011,1 1 1 1 1 1 1 1 1 1 1 0,DDoSRSTrp">
        <slice>
            <filter src_ip="200.104.30.115"/>
            <filter src_ip="200.104.30.108"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.491220,1.874700,010,1 1 1 1 1 1 1 0 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="200.104.30.115"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315545300"/>
    </anomaly>
    <anomaly type="anomalous" value="1.998470,1.384980,503,1 0 0 1 1 1 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="180.9.45.35" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.818490,1.363230,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="164.12.64.145" src_port="80"/>
            <filter src_ip="178.75.93.217" dst_ip="216.26.32.190" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.933640,1.490530,010,1 1 0 1 1 0 1 1 1 1 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="200.104.30.108"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.280970,1.278370,503,1 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="153.15.6.51" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.818490,1.363230,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="201.33.105.172" src_port="80"/>
            <filter dst_ip="201.33.106.70" src_port="80"/>
            <filter dst_ip="201.33.106.70" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.253310,1.209820,503,1 0 0 1 0 0 1 1 1 1 0 0,ntscACK">
        <slice>
            <filter src_ip="201.40.91.145" src_port="18550"/>
            <filter src_ip="201.40.91.145" dst_port="80"/>
            <filter src_ip="201.40.91.145" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.280970,1.278370,503,1 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="201.33.105.154" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.857510,1.336340,503,0 0 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="200.104.24.24" src_port="80"/>
            <filter src_ip="153.15.6.60" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.857510,1.336340,503,0 0 0 1 1 1 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="200.104.19.68" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.818490,1.363230,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="178.75.238.106" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.818490,1.363230,502,0 0 0 1 1 1 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="200.104.27.229" dst_ip="192.101.51.172" dst_port="22"/>
            <filter src_ip="200.104.25.54" dst_ip="192.101.51.172" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.857510,1.336340,503,0 0 0 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="201.40.91.145" src_port="53"/>
            <filter dst_ip="201.40.91.145" src_port="80"/>
            <filter dst_ip="201.40.91.145" dst_port="18550"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.261130,1.237190,503,0 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="178.75.9.238" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924543,1.270170,503,1 0 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="200.104.31.19" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1315545247"/>
        <to usec="0" sec="1315545250"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924543,1.270170,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="200.104.19.109" dst_ip="200.104.19.109" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1315545238"/>
        <to usec="0" sec="1315545264"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924543,1.270170,010,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="107.42.133.6" dst_port="445" proto="tcp"/>
        </slice>
        <from usec="0" sec="1315544733"/>
        <to usec="0" sec="1315544768"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924543,1.270170,999,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.39.232.190" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545243"/>
        <to usec="0" sec="1315545280"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924543,1.270170,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="73.76.142.192"/>
        </slice>
        <from usec="0" sec="1315545278"/>
        <to usec="0" sec="1315545280"/>
    </anomaly>
    <anomaly type="suspicious" value="1.282650,1.449370,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="200.104.19.109" dst_ip="200.104.19.109" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1315545238"/>
        <to usec="0" sec="1315545264"/>
    </anomaly>
    <anomaly type="suspicious" value="0.896852,1.228720,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544688"/>
    </anomaly>
    <anomaly type="suspicious" value="0.896852,1.228720,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="137.79.88.213"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544688"/>
    </anomaly>
    <anomaly type="suspicious" value="0.896852,1.228720,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="33.26.150.1"/>
        </slice>
        <from usec="0" sec="1315544436"/>
        <to usec="0" sec="1315544671"/>
    </anomaly>
    <anomaly type="suspicious" value="0.896852,1.228720,503,0 0 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="178.185.100.20"/>
        </slice>
        <from usec="0" sec="1315544501"/>
        <to usec="0" sec="1315544688"/>
    </anomaly>
    <anomaly type="suspicious" value="0.896852,1.228720,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="216.26.88.17"/>
        </slice>
        <from usec="0" sec="1315544552"/>
        <to usec="0" sec="1315544687"/>
    </anomaly>
    <anomaly type="suspicious" value="0.896852,1.228720,999,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter dst_ip="76.45.128.163"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315545047"/>
    </anomaly>
    <anomaly type="suspicious" value="1.221200,1.252810,999,1 0 0 1 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="201.141.127.115" dst_ip="10.64.17.12" src_port="53"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315545285"/>
    </anomaly>
    <anomaly type="suspicious" value="1.113910,1.195510,503,0 0 0 0 0 0 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="201.33.105.172" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.973545,1.198810,999,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="53"/>
            <filter dst_ip="200.104.25.40" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="suspicious" value="0.999114,1.241260,503,1 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="180.9.122.215" dst_ip="201.41.151.68" dst_port="80"/>
        </slice>
        <from usec="0" sec="1315544805"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.113910,1.195510,503,0 0 0 0 0 0 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="200.104.19.109" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880330,1.140880,503,0 0 0 0 0 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter src_ip="66.103.4.175" dst_ip="200.104.16.228"/>
            <filter src_ip="66.103.4.175" src_port="80"/>
            <filter dst_ip="200.104.16.228" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148270,1.197490,011,1 0 0 0 0 0 1 1 1 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="200.104.18.118"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.022610,1.191910,503,0 0 0 0 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="200.104.19.109" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.047550,1.225500,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="66.103.31.85" dst_ip="178.75.203.220" src_port="80" dst_port="4921"/>
            <filter src_ip="66.103.31.85" dst_ip="178.75.203.220" src_port="80" dst_port="4919"/>
            <filter src_ip="66.103.31.85" dst_ip="178.75.203.220" src_port="80" dst_port="4879"/>
            <filter src_ip="66.103.31.85" dst_ip="178.75.203.220" src_port="80" dst_port="4856"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966553,1.227790,503,1 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="153.15.6.51" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.794691,1.172270,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="147.142.225.111" dst_ip="153.15.65.97" src_port="80" dst_port="51773"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.794691,1.172270,503,0 0 0 0 0 0 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="216.202.18.102" dst_ip="153.15.164.207" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.047550,1.225500,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="35.149.39.211" dst_ip="153.15.130.224" src_port="443"/>
            <filter src_ip="144.73.68.115" dst_ip="153.15.130.224" src_port="80"/>
            <filter src_ip="216.202.241.67" dst_ip="153.15.130.224" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.038110,1.197860,010,1 0 0 0 0 0 1 1 1 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.104.18.118"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.794691,1.172270,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="153.15.65.3" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880330,1.140880,999,0 0 0 0 0 0 1 1 1 1 1 0,ipv46tun">
        <slice>
            <filter src_ip="192.15.208.170"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.047550,1.225500,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="181.7.169.92" dst_ip="216.26.32.148"/>
            <filter dst_ip="216.26.32.148" src_port="80"/>
            <filter src_ip="181.7.169.92" dst_ip="116.68.104.21" src_port="80"/>
            <filter src_ip="181.7.169.92" dst_ip="116.68.108.240" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.761519,1.137100,999,0 0 0 0 0 0 1 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="178.75.9.134" src_port="25"/>
            <filter src_ip="178.75.9.134" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.047550,1.225500,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="200.104.20.219" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.794691,1.172270,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="178.85.78.5" dst_ip="216.26.32.8"/>
            <filter dst_ip="216.26.32.8" src_port="80"/>
            <filter src_ip="178.85.78.5" dst_ip="116.68.104.150" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.047550,1.225500,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="180.9.119.61" dst_ip="116.68.108.131"/>
            <filter src_ip="180.9.119.61" src_port="80"/>
            <filter src_ip="153.15.6.56" src_port="80"/>
            <filter dst_ip="116.68.108.131" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.794691,1.172270,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="153.15.209.8" dst_ip="138.202.21.218" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.794691,1.172270,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="153.15.4.6" dst_ip="117.196.145.132"/>
            <filter dst_ip="117.196.145.132" src_port="80"/>
            <filter src_ip="153.15.4.6" dst_ip="72.79.104.98" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.794691,1.172270,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="200.104.24.157" src_port="80"/>
            <filter src_ip="178.85.192.57" dst_ip="216.26.32.94" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.794691,1.172270,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="153.15.101.48" src_port="80"/>
            <filter src_ip="217.78.195.155" dst_ip="180.9.92.115" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.794691,1.172270,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="153.15.182.155" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.794691,1.172270,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="153.15.160.99" dst_port="17012"/>
            <filter src_ip="205.239.150.47" dst_ip="153.15.160.99" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.047550,1.225500,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="153.15.166.50" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.047550,1.225500,999,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="124.75.198.211" src_port="993"/>
            <filter src_ip="124.75.198.211" src_port="995"/>
            <filter dst_ip="153.15.155.199" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.047550,1.225500,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="153.15.216.230" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.047550,1.225500,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="153.15.101.36" dst_ip="147.134.218.76" src_port="52445" dst_port="443"/>
            <filter src_ip="178.185.101.92" dst_ip="147.134.218.76" src_port="60661" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.047550,1.225500,502,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="192.101.51.172" dst_ip="200.104.27.229" src_port="22"/>
            <filter src_ip="192.101.51.172" dst_ip="200.104.25.54" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.880330,1.140880,504,0 0 0 0 0 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter src_ip="180.9.113.18" dst_port="80"/>
            <filter src_ip="180.9.113.12" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.794691,1.172270,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="164.12.13.73" src_port="80"/>
            <filter dst_ip="216.26.32.64" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.794691,1.172270,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="178.75.233.42" dst_ip="216.26.32.2" src_port="80"/>
            <filter src_ip="200.104.31.80" dst_ip="216.26.32.2" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
