<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.404010,2.180550,010,1 1 1 0 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="41.178.33.6" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.575370,2.229820,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="199.232.183.140" dst_port="445"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987646"/>
    </anomaly>
    <anomaly type="anomalous" value="2.482360,2.256850,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="78.228.110.63" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1320987658"/>
        <to usec="0" sec="1320987659"/>
    </anomaly>
    <anomaly type="anomalous" value="3.989610,2.533780,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="41.177.88.26" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.675560,2.057280,010,1 1 0 1 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="198.35.105.77"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320988498"/>
    </anomaly>
    <anomaly type="anomalous" value="2.628900,1.963620,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="175.155.38.241" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.483660,1.957780,503,0 0 0 1 1 1 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="138.102.224.155" dst_ip="169.105.229.45" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.532340,2.071810,999,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="144.166.51.135" dst_ip="35.220.215.145" src_port="8901" dst_port="11343"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320988427"/>
    </anomaly>
    <anomaly type="anomalous" value="3.222640,2.326520,010,1 1 1 1 0 0 1 1 1 1 1 0,DDoSSYN">
        <slice>
            <filter dst_ip="198.35.101.219"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.421020,2.181130,010,1 1 0 1 1 1 1 1 1 1 1 0,DDoSSYN">
        <slice>
            <filter dst_ip="199.186.164.124"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.913090,1.701680,503,1 1 0 0 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="198.35.100.98" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.106790,1.982640,010,1 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="198.35.101.208"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320988472"/>
    </anomaly>
    <anomaly type="anomalous" value="3.754170,2.388270,999,1 1 1 1 1 1 1 1 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="198.35.182.56" src_port="51997"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.875630,2.132740,999,1 1 1 1 0 0 1 0 0 1 1 1,ipv46tun">
        <slice>
            <filter src_ip="202.159.128.181"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.657150,1.655770,503,1 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="198.35.100.98" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.096320,1.973120,503,1 1 0 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="198.35.100.74" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.745010,1.930290,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="169.105.229.73" src_port="80"/>
            <filter dst_ip="169.105.192.16" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.547930,2.377870,999,1 1 1 1 1 1 0 0 0 1 1 1,empty">
        <slice>
            <filter src_ip="106.180.167.9"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.076760,1.903690,999,0 0 0 0 0 0 1 1 1 1 1 1,mptpla">
        <slice>
            <filter src_ip="41.213.194.156" dst_ip="199.186.181.157"/>
            <filter src_ip="46.172.52.124" dst_ip="199.186.181.157"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.296100,2.119380,503,1 0 0 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="198.35.100.74" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.048010,1.863160,020,1 0 0 0 0 0 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="198.35.101.218" dst_port="53"/>
            <filter dst_ip="198.35.101.218"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.076760,1.903690,999,0 0 0 0 0 0 1 1 1 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.42.90.85" dst_port="53"/>
            <filter dst_ip="198.35.108.77" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.754170,2.388270,503,1 1 1 1 1 1 1 1 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="199.186.3.155" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.296100,2.119380,503,1 0 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="199.186.1.31" src_port="80"/>
            <filter dst_ip="199.186.3.155" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.613620,2.352240,503,1 1 1 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="199.186.1.31" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.613620,2.352240,503,1 1 1 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="198.35.109.147" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.785920,1.736950,011,1 1 0 0 0 0 0 0 0 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="41.177.88.26" src_port="3306" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.296100,2.119380,503,1 0 0 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="199.179.130.95" src_port="80"/>
            <filter dst_ip="199.179.130.95" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.527880,2.186370,503,1 1 0 1 1 1 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="199.179.130.95" dst_port="80"/>
            <filter src_ip="199.179.130.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.527510,2.124290,010,1 1 1 0 0 0 1 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="44.68.110.55" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.019410,2.003620,503,1 1 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="199.186.5.187" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.989610,2.533780,011,1 1 1 1 1 1 1 1 1 1 1 1,DDoSRSTrp">
        <slice>
            <filter src_ip="198.35.101.219"/>
            <filter src_ip="199.186.164.124"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.913090,1.701680,503,1 1 0 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="205.166.82.96" dst_port="80"/>
            <filter dst_ip="205.166.82.96" dst_port="443"/>
            <filter dst_ip="6.17.90.135" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.062070,1.670670,504,1 0 0 1 0 0 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="205.166.83.16" dst_port="80"/>
            <filter dst_ip="205.166.83.16" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.640470,1.858380,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="144.166.188.80" dst_ip="152.109.144.29" src_port="56041" dst_port="80"/>
        </slice>
        <from usec="0" sec="1320987736"/>
        <to usec="0" sec="1320987738"/>
    </anomaly>
    <anomaly type="suspicious" value="1.640470,1.858380,503,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="144.166.212.178" dst_ip="211.114.147.12" src_port="80" dst_port="1383"/>
        </slice>
        <from usec="0" sec="1320988228"/>
        <to usec="0" sec="1320988230"/>
    </anomaly>
    <anomaly type="suspicious" value="1.640470,1.858380,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="35.192.185.155" dst_ip="169.105.202.146" src_port="80"/>
        </slice>
        <from usec="0" sec="1320988232"/>
        <to usec="0" sec="1320988242"/>
    </anomaly>
    <anomaly type="suspicious" value="1.519290,1.764940,503,1 1 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="144.166.212.190" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.640470,1.858380,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="172.20.32.73" src_port="2425" dst_port="2425"/>
        </slice>
        <from usec="0" sec="1320988203"/>
        <to usec="0" sec="1320988207"/>
    </anomaly>
    <anomaly type="suspicious" value="1.640470,1.858380,011,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="41.140.225.7" src_port="1433"/>
        </slice>
        <from usec="0" sec="1320988211"/>
        <to usec="0" sec="1320988213"/>
    </anomaly>
    <anomaly type="suspicious" value="1.274280,1.818780,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="216.240.240.212"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987708"/>
    </anomaly>
    <anomaly type="suspicious" value="1.274280,1.818780,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="169.105.231.88"/>
        </slice>
        <from usec="0" sec="1320987602"/>
        <to usec="0" sec="1320987739"/>
    </anomaly>
    <anomaly type="suspicious" value="1.274280,1.818780,999,0 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="169.105.49.19"/>
        </slice>
        <from usec="0" sec="1320987603"/>
        <to usec="0" sec="1320987967"/>
    </anomaly>
    <anomaly type="suspicious" value="1.274280,1.818780,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="38.44.136.46"/>
        </slice>
        <from usec="0" sec="1320987680"/>
        <to usec="0" sec="1320987978"/>
    </anomaly>
    <anomaly type="suspicious" value="1.274280,1.818780,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="153.24.61.58"/>
        </slice>
        <from usec="0" sec="1320987603"/>
        <to usec="0" sec="1320988064"/>
    </anomaly>
    <anomaly type="suspicious" value="1.274280,1.818780,504,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="194.55.74.246"/>
        </slice>
        <from usec="0" sec="1320987608"/>
        <to usec="0" sec="1320987994"/>
    </anomaly>
    <anomaly type="suspicious" value="1.274280,1.818780,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="1.140.105.73"/>
        </slice>
        <from usec="0" sec="1320987910"/>
        <to usec="0" sec="1320988027"/>
    </anomaly>
    <anomaly type="suspicious" value="1.274280,1.818780,020,0 0 0 1 0 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="192.168.100.11"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320988157"/>
    </anomaly>
    <anomaly type="suspicious" value="1.274280,1.818780,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="44.243.106.238"/>
        </slice>
        <from usec="0" sec="1320988042"/>
        <to usec="0" sec="1320988045"/>
    </anomaly>
    <anomaly type="suspicious" value="1.274280,1.818780,504,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="6.17.90.95"/>
        </slice>
        <from usec="0" sec="1320987601"/>
        <to usec="0" sec="1320988225"/>
    </anomaly>
    <anomaly type="suspicious" value="1.274280,1.818780,504,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="144.166.72.2"/>
        </slice>
        <from usec="0" sec="1320987605"/>
        <to usec="0" sec="1320988237"/>
    </anomaly>
    <anomaly type="suspicious" value="1.411180,1.828790,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="199.186.161.80" src_port="27745"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.411180,1.828790,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="169.105.224.132" src_port="53"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.953100,2.015100,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="198.35.102.24" src_port="80"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.411180,1.828790,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="175.19.71.189"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.411180,1.828790,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="144.166.244.37" src_port="53"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.953100,2.015100,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="198.35.98.45" src_port="53"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.953100,2.015100,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="175.41.137.225" dst_port="54513"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.321820,1.698520,999,0 0 0 0 0 0 1 1 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="198.35.104.163" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.953100,2.015100,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="144.166.65.107" dst_port="52743"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.321820,1.698520,020,0 0 0 0 0 0 1 1 0 1 1 0,icmp_error">
        <slice>
            <filter dst_ip="198.35.108.157"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.268290,1.733750,999,0 0 0 0 0 0 1 1 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="175.19.81.21" src_port="53"/>
            <filter dst_ip="175.19.81.21" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.268290,1.733750,999,0 0 0 0 0 0 1 1 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="198.35.104.164" dst_ip="105.26.46.205" dst_port="53"/>
            <filter src_ip="144.166.190.97" dst_ip="105.26.46.205" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.411180,1.828790,010,0 0 0 0 0 0 1 1 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="198.35.101.208" dst_port="11785"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.953100,2.015100,010,0 0 0 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="198.35.101.208" dst_port="28404"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.953100,2.015100,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="198.35.106.186" dst_ip="216.222.9.219" dst_port="80"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.953100,2.015100,999,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="144.166.50.137" dst_ip="105.4.188.249" dst_port="53"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.889540,1.897670,999,0 0 0 0 0 0 1 1 1 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="199.186.161.80" dst_port="27745"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.411180,1.828790,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="198.35.106.15" dst_port="53"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.953100,2.015100,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="175.155.156.146" dst_ip="193.148.194.234" dst_port="80"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.411180,1.828790,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="198.35.102.24" src_port="16752"/>
        </slice>
        <from usec="0" sec="1320987960"/>
        <to usec="0" sec="1320988051"/>
    </anomaly>
    <anomaly type="suspicious" value="1.519410,2.002760,010,0 0 0 0 0 0 0 0 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="198.35.101.208" dst_port="8197"/>
        </slice>
        <from usec="0" sec="1320987600"/>
        <to usec="0" sec="1320987646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.308180,1.687630,999,0 0 0 1 0 0 1 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="135.66.17.227" dst_ip="146.188.236.54" dst_port="53"/>
            <filter src_ip="135.66.17.227" dst_ip="146.188.236.56" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.577910,1.705250,999,0 0 0 0 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="199.186.1.181" dst_port="53"/>
            <filter dst_ip="202.227.124.95" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.205910,1.654400,504,0 0 0 0 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="9.109.4.79" dst_port="443"/>
            <filter src_ip="199.186.171.205" dst_ip="9.109.4.79" dst_port="80"/>
            <filter src_ip="198.35.104.17" dst_ip="9.109.4.79" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.267990,1.651820,503,1 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="169.105.100.174" dst_ip="2.19.36.235" src_port="59447" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.321820,1.698520,999,0 0 0 0 0 0 1 1 0 1 1 0,ptpposcaUDP">
        <slice>
            <filter src_ip="199.35.205.240" dst_ip="10.0.0.4" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.577910,1.705250,999,0 0 0 0 0 0 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="199.186.1.181" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.564260,1.730350,503,1 1 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="169.105.1.75" src_port="80"/>
            <filter src_ip="154.26.176.92" dst_ip="144.166.21.72" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.267990,1.651820,503,1 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="144.166.50.107" dst_ip="24.148.119.177" src_port="1468" dst_port="5938"/>
            <filter src_ip="144.166.50.107" dst_ip="2.19.59.95" src_port="1651" dst_port="80"/>
            <filter src_ip="144.166.50.107" dst_ip="152.107.99.179" src_port="1659" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.411180,1.828790,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="198.35.101.209" src_port="23269"/>
        </slice>
        <from usec="0" sec="1320987960"/>
        <to usec="0" sec="1320988366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.205910,1.654400,503,0 0 0 0 0 0 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="198.35.109.147" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
