<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.821650,1.558520,503,1 1 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="176.206.218.59" dst_ip="73.114.57.225" src_port="80" dst_port="52870"/>
            <filter src_ip="176.206.218.59" dst_ip="73.114.57.225" src_port="80" dst_port="46642"/>
            <filter src_ip="176.206.218.59" dst_ip="73.114.57.225" src_port="80" dst_port="39858"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.415290,1.959610,503,1 1 1 0 0 0 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="205.122.227.139" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.178930,1.944620,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="33.190.165.4" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1318223611"/>
        <to usec="0" sec="1318223657"/>
    </anomaly>
    <anomaly type="anomalous" value="2.178930,1.944620,010,1 1 1 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="120.34.8.16" src_port="6000" dst_port="8909"/>
        </slice>
        <from usec="0" sec="1318222936"/>
        <to usec="0" sec="1318222982"/>
    </anomaly>
    <anomaly type="anomalous" value="2.677040,2.070530,010,1 1 1 1 1 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="204.64.144.75"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318223702"/>
    </anomaly>
    <anomaly type="anomalous" value="2.015960,1.482620,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="205.114.32.4" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.015960,1.482620,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="137.105.52.29" dst_port="80"/>
            <filter src_ip="137.105.52.29" dst_ip="79.77.158.181" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.156170,1.538580,503,1 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="137.105.176.5" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.725740,1.462740,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="176.213.166.236" dst_ip="219.84.81.131" src_port="80"/>
        </slice>
        <from usec="0" sec="1318222804"/>
        <to usec="0" sec="1318222999"/>
    </anomaly>
    <anomaly type="anomalous" value="1.725740,1.462740,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="137.105.197.65" dst_port="6502"/>
            <filter src_ip="218.17.177.244" dst_ip="137.105.197.65" src_port="80"/>
        </slice>
        <from usec="0" sec="1318222807"/>
        <to usec="0" sec="1318223089"/>
    </anomaly>
    <anomaly type="anomalous" value="1.414900,1.307500,503,0 0 0 1 1 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="201.3.204.4" dst_ip="137.105.181.158" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.015960,1.482620,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="218.181.225.60" src_port="80"/>
            <filter src_ip="160.194.169.79" dst_ip="73.114.53.58" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.015960,1.482620,503,0 0 0 1 1 1 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="64.40.178.33" dst_ip="137.105.231.83" src_port="80" dst_port="45317"/>
            <filter src_ip="64.40.178.161" dst_ip="137.105.231.83" src_port="80" dst_port="58601"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.339930,1.328850,999,0 0 0 1 0 0 1 1 1 1 0 0,ipv46tun">
        <slice>
            <filter src_ip="194.94.37.181"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.968260,1.552360,999,1 1 0 1 1 0 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="204.64.22.43" src_port="50194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.181980,1.548340,503,0 0 0 1 1 1 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="204.64.145.45" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.898020,2.131410,010,1 1 1 1 1 1 1 1 1 1 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="204.64.144.74"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.858350,1.435270,503,0 0 0 1 1 1 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="204.64.156.132" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.058850,2.165310,011,1 1 1 1 1 1 1 1 1 1 1 1,DDoSRSTrp">
        <slice>
            <filter src_ip="204.64.144.74"/>
            <filter src_ip="204.64.144.75"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.989970,1.451980,502,0 0 0 1 1 1 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="81.240.134.231" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.419000,1.367070,010,1 0 0 0 0 0 1 1 1 1 1 0,DDoSSYN">
        <slice>
            <filter dst_ip="204.64.144.67"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.989970,1.451980,503,0 0 0 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="204.64.156.132" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.427990,1.355730,502,0 0 0 0 0 0 1 1 1 1 1 1,ptmp">
        <slice>
            <filter src_ip="81.240.134.231" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.350220,1.310700,503,1 0 0 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="176.201.0.49" src_port="80"/>
            <filter dst_ip="176.201.0.50" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.917229,1.322620,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="109.78.142.148" dst_ip="205.114.145.173" src_port="80" dst_port="61889" proto="tcp"/>
        </slice>
        <from usec="0" sec="1318223037"/>
        <to usec="0" sec="1318223043"/>
    </anomaly>
    <anomaly type="suspicious" value="0.917229,1.322620,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="155.100.89.160"/>
        </slice>
        <from usec="0" sec="1318223250"/>
        <to usec="0" sec="1318223255"/>
    </anomaly>
    <anomaly type="suspicious" value="0.917229,1.322620,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="160.194.17.40" dst_ip="218.181.225.32" src_port="80" dst_port="53705" proto="tcp"/>
        </slice>
        <from usec="0" sec="1318222813"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.917229,1.322620,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="137.105.197.58" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1318223669"/>
        <to usec="0" sec="1318223683"/>
    </anomaly>
    <anomaly type="suspicious" value="0.917229,1.322620,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="137.105.197.58" dst_ip="58.171.138.209" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1318223669"/>
        <to usec="0" sec="1318223697"/>
    </anomaly>
    <anomaly type="suspicious" value="0.917229,1.322620,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="96.133.225.48" src_port="6000" dst_port="4899" proto="tcp"/>
        </slice>
        <from usec="0" sec="1318223544"/>
        <to usec="0" sec="1318223545"/>
    </anomaly>
    <anomaly type="suspicious" value="1.494160,1.539620,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="108.9.35.47" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1318223590"/>
        <to usec="0" sec="1318223620"/>
    </anomaly>
    <anomaly type="suspicious" value="1.494160,1.539620,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="84.242.27.22" dst_port="445"/>
            <filter src_ip="84.242.27.22" dst_port="139"/>
        </slice>
        <from usec="0" sec="1318223160"/>
        <to usec="0" sec="1318223205"/>
    </anomaly>
    <anomaly type="suspicious" value="1.494160,1.539620,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="92.7.102.57" dst_port="139"/>
        </slice>
        <from usec="0" sec="1318223071"/>
        <to usec="0" sec="1318223111"/>
    </anomaly>
    <anomaly type="suspicious" value="0.985181,1.285990,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="72.244.176.184"/>
        </slice>
        <from usec="0" sec="1318222868"/>
        <to usec="0" sec="1318223472"/>
    </anomaly>
    <anomaly type="suspicious" value="0.985181,1.285990,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="103.60.120.67"/>
        </slice>
        <from usec="0" sec="1318223412"/>
        <to usec="0" sec="1318223488"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="73.156.245.179" src_port="80"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="204.64.155.164" src_port="58228"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318223657"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="205.137.10.57" dst_ip="10.64.17.12" src_port="53"/>
            <filter src_ip="205.137.10.57" dst_ip="10.5.100.10" src_port="53"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318223702"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="204.64.146.164" dst_port="80"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="205.114.144.176" src_port="20507"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318223432"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="123.1.255.160" src_port="80"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="109.78.130.13" dst_ip="180.157.70.22" src_port="80"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="176.213.33.111" dst_ip="106.67.178.219" src_port="123"/>
            <filter src_ip="176.213.33.111" dst_ip="150.82.90.90" src_port="123"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318223702"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="129.148.28.21" src_port="80"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039770,1.300890,999,0 0 0 0 0 0 1 1 1 1 0 0,ptmp">
        <slice>
            <filter src_ip="205.114.144.100" src_port="39947"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="204.64.154.66"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318223432"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="176.213.194.108" src_port="53"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="205.114.36.57" dst_ip="75.206.68.37" dst_port="80"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="204.64.144.66" dst_port="53"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="204.64.144.66" dst_port="80"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="205.114.128.15" dst_port="53"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,502,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="33.54.21.114" dst_port="22"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="176.213.68.82" dst_port="53"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="204.64.157.84" dst_port="53"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="172.20.32.48" src_port="2425" dst_port="2425"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="205.122.210.226" dst_port="53"/>
            <filter src_ip="205.122.210.226" dst_port="80"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318223432"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="204.64.150.101" dst_port="53"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="176.213.194.109" dst_port="53"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.976354,1.333960,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="204.64.156.224" dst_ip="201.202.191.188" dst_port="53"/>
            <filter src_ip="204.64.156.224"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318223252"/>
    </anomaly>
    <anomaly type="suspicious" value="1.028280,1.367240,503,0 0 0 0 0 0 0 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="137.105.197.163" dst_port="80"/>
        </slice>
        <from usec="0" sec="1318222801"/>
        <to usec="0" sec="1318222847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.855331,1.225000,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="137.105.176.5" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.101140,1.256890,503,1 0 0 0 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="204.64.145.5" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.112700,1.244540,503,0 0 0 0 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="204.64.145.45" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.855331,1.225000,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="180.157.62.2" dst_ip="219.41.209.160" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158530,1.280150,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="160.194.202.74" dst_ip="218.181.225.204" src_port="80" dst_port="53084"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158530,1.280150,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="137.105.66.194" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158350,1.218290,503,0 0 0 1 0 0 1 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="205.114.38.196" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158530,1.280150,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="205.114.146.177" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.855331,1.225000,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="219.29.18.194" dst_ip="137.105.33.44" src_port="80" dst_port="54145"/>
            <filter src_ip="219.29.18.194" dst_ip="137.105.2.166" src_port="80" dst_port="4399"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158530,1.280150,999,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="137.105.234.111"/>
            <filter src_ip="64.40.26.246" src_port="993"/>
            <filter src_ip="64.40.26.246" src_port="995"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.147430,1.292160,503,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="101.104.129.21" src_port="80"/>
            <filter src_ip="78.113.211.141" dst_ip="137.105.193.115" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158530,1.280150,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="137.105.104.189" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.855331,1.225000,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="137.105.197.220" src_port="80"/>
            <filter dst_ip="205.114.146.177" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.855331,1.225000,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="205.114.39.141" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158530,1.280150,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="204.64.145.5" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.855331,1.225000,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="137.105.33.68" dst_ip="201.140.146.217" src_port="57816" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158530,1.280150,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="176.213.166.236" dst_ip="219.84.81.128" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.855331,1.225000,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="176.213.166.236" dst_ip="219.84.81.154" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158530,1.280150,501,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="160.194.160.168" dst_ip="218.181.225.52" src_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158530,1.280150,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="176.206.95.184" dst_ip="218.181.225.1" src_port="80"/>
            <filter src_ip="176.206.95.5" dst_ip="73.114.49.34" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.855331,1.225000,010,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="217.225.169.254" dst_ip="52.151.178.216" src_port="80"/>
            <filter src_ip="216.67.228.30" dst_ip="52.151.178.216" src_port="80"/>
            <filter src_ip="217.225.169.245" dst_ip="52.151.178.216" src_port="80"/>
            <filter src_ip="217.225.169.241" dst_ip="52.151.178.216" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
