<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="notice" value="0.509526,1.183110,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="213.4.99.50"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,020,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="200.104.24.100" dst_ip="205.73.70.118" dst_port="53"/>
            <filter src_ip="200.104.24.100"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="34.220.105.177" src_port="80"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="81.68.192.104" src_port="80"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,010,0 0 0 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_port="4935" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_port="5060" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="154.147.1.27" src_port="53"/>
        </slice>
        <from usec="0" sec="1315544670"/>
        <to usec="0" sec="1315544716"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter dst_ip="128.154.107.182"/>
        </slice>
        <from usec="0" sec="1315544670"/>
        <to usec="0" sec="1315544716"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,503,0 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="180.9.116.1" dst_ip="118.102.213.184" src_port="80"/>
        </slice>
        <from usec="0" sec="1315544670"/>
        <to usec="0" sec="1315544716"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.15.115.103"/>
        </slice>
        <from usec="0" sec="1315544670"/>
        <to usec="0" sec="1315544716"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="180.9.65.147"/>
        </slice>
        <from usec="0" sec="1315544895"/>
        <to usec="0" sec="1315544941"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,504,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="201.41.140.253"/>
        </slice>
        <from usec="0" sec="1315544895"/>
        <to usec="0" sec="1315544941"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="153.15.40.29"/>
        </slice>
        <from usec="0" sec="1315544985"/>
        <to usec="0" sec="1315545031"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="178.135.212.216"/>
        </slice>
        <from usec="0" sec="1315545120"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="180.9.36.111"/>
        </slice>
        <from usec="0" sec="1315545120"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="178.185.165.4"/>
        </slice>
        <from usec="0" sec="1315545120"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="207.115.222.161" dst_ip="154.147.1.26" src_port="53"/>
        </slice>
        <from usec="0" sec="1315544670"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="154.147.1.27" src_port="53"/>
        </slice>
        <from usec="0" sec="1315545120"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.15.40.29"/>
        </slice>
        <from usec="0" sec="1315545120"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,020,0 0 0 0 0 0 1 0 0 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="200.104.25.179"/>
        </slice>
        <from usec="0" sec="1315545120"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.80.124.61" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545120"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.39.232.190" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545120"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.40.111.0" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545120"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.40.111.3" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545120"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.104.25.46" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545120"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.104.19.116" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545120"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.104.28.183" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545120"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.509526,1.183110,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.33.186.168" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545120"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.631200,1.214640,999,0 0 0 0 0 0 0 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="153.15.164.185"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="201.40.110.140" dst_port="80"/>
            <filter src_ip="201.40.110.140" dst_port="53"/>
            <filter src_ip="201.40.110.140" dst_ip="119.230.9.44" dst_port="443"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="201.40.111.0" src_port="53"/>
            <filter src_ip="201.40.111.0" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.588889,1.180740,504,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="180.9.113.10" dst_port="80"/>
            <filter src_ip="180.9.113.10" dst_port="443"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="180.9.122.215" dst_port="80"/>
            <filter src_ip="180.9.122.215" dst_port="443"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="178.75.196.164" src_port="57956"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.588889,1.180740,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.135.212.216" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="180.9.36.111" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.185.165.4" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="178.75.105.202" dst_port="80"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="201.33.189.35" src_port="10508"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.75.9.202" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.104.25.54" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,053,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="153.15.6.10" dst_ip="118.102.213.23" src_port="80"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.730843,1.141270,503,0 0 0 0 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="178.75.9.239" dst_ip="116.68.104.235"/>
            <filter dst_ip="116.68.104.235" src_port="80"/>
            <filter src_ip="178.75.9.239" dst_ip="118.102.213.184" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="178.75.152.206" src_port="5041" dst_port="5041"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="153.15.40.29" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="153.15.41.175" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.104.20.18" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="81.68.230.31" src_port="80"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="201.33.105.16" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,503,0 0 0 0 0 0 1 1 1 0 0 0,point_to_point">
        <slice>
            <filter src_ip="75.90.84.61" dst_ip="180.9.9.82" src_port="80"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="212.34.67.197" src_port="80"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.75.130.27" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.104.31.33" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,503,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="78.33.103.80" dst_ip="200.104.18.119" dst_port="80"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315544446"/>
    </anomaly>
    <anomaly type="notice" value="0.588889,1.180740,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.75.105.192" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315544985"/>
        <to usec="0" sec="1315545031"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.104.18.123" src_port="23269"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.75.152.234" src_port="64720"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter src_ip="200.241.106.100"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="201.40.110.140" dst_port="80"/>
            <filter src_ip="201.40.110.140" dst_port="53"/>
            <filter src_ip="201.40.110.140" dst_ip="119.230.9.44" dst_port="443"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.730843,1.141270,503,0 0 0 0 0 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="178.75.31.74" dst_port="80"/>
            <filter src_ip="178.75.31.74" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="213.4.99.50"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,504,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="201.40.115.230" dst_port="443"/>
            <filter src_ip="201.40.115.230" dst_port="8612"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.75.196.144" src_port="34206"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="200.104.30.157"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,020,0 0 0 0 0 0 1 1 1 0 0 0,empty">
        <slice>
            <filter src_ip="147.136.112.6"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="201.40.125.41" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="180.9.36.111" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="180.9.117.239" src_port="53"/>
            <filter src_ip="180.9.117.239" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="201.33.186.32" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.75.9.202" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.75.9.200" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="34.220.105.177" src_port="80"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="153.15.6.63" src_port="80"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.104.25.54" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,503,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="180.9.113.2" dst_ip="192.14.243.178" dst_port="80"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="153.15.40.29" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="153.15.41.175" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="153.15.216.230" dst_port="80"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="148.67.217.144" dst_ip="200.104.27.210" dst_port="80"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="201.33.105.16" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.75.9.128" src_port="53"/>
            <filter src_ip="178.75.9.128" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="81.68.192.104" src_port="80"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,010,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="130.245.200.1" dst_ip="178.135.110.102" src_port="12057"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.104.31.87" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.75.130.26" src_port="53"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.75.130.27" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="200.104.24.100" dst_ip="205.73.70.118" dst_port="53"/>
            <filter src_ip="200.104.24.100" dst_ip="197.129.82.161" dst_port="53"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="123" dst_port="123"/>
            <filter src_ip="178.75.81.174" dst_ip="128.182.125.17" src_port="123"/>
        </slice>
        <from usec="0" sec="1315544400"/>
        <to usec="0" sec="1315545166"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,010,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="4935" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="178.75.8.0"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="153.15.91.81"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="130.35.159.163"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="201.64.40.246"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="201.33.107.46"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="200.104.31.19"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="71.141.102.71"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,002,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="178.135.217.91"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="178.185.33.236"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,999,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="153.15.164.191"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,999,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="153.15.216.168"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="147.142.225.111"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="130.35.159.163"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="213.161.160.66"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="116.68.104.242"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,999,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="116.68.108.74"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.625047,1.172640,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="117.196.147.92"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.674305,1.186740,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.75.197.164" src_port="58732"/>
        </slice>
        <from usec="0" sec="1315545075"/>
        <to usec="0" sec="1315545121"/>
    </anomaly>
</admd:annotation>
