<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.060020,1.239960,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter proto="icmp"/>
        </slice>
        <from usec="0" sec="1323666002"/>
        <to usec="0" sec="1323666898"/>
    </anomaly>
    <anomaly type="suspicious" value="1.060020,1.239960,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="152.93.23.140" dst_ip="32.234.238.250" src_port="26472" dst_port="1935" proto="tcp"/>
        </slice>
        <from usec="0" sec="1323666009"/>
        <to usec="0" sec="1323666767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.060020,1.239960,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="152.93.32.97"/>
        </slice>
        <from usec="0" sec="1323666146"/>
        <to usec="0" sec="1323666196"/>
    </anomaly>
    <anomaly type="suspicious" value="1.060020,1.239960,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="177.219.66.154"/>
        </slice>
        <from usec="0" sec="1323666474"/>
        <to usec="0" sec="1323666476"/>
    </anomaly>
    <anomaly type="suspicious" value="1.060020,1.239960,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="177.219.136.134" dst_ip="201.171.252.13" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1323666635"/>
        <to usec="0" sec="1323666744"/>
    </anomaly>
    <anomaly type="suspicious" value="1.060020,1.239960,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter proto="icmp"/>
        </slice>
        <from usec="0" sec="1323666011"/>
        <to usec="0" sec="1323666357"/>
    </anomaly>
    <anomaly type="suspicious" value="1.292230,1.387080,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter proto="icmp"/>
        </slice>
        <from usec="0" sec="1323666021"/>
        <to usec="0" sec="1323666896"/>
    </anomaly>
    <anomaly type="suspicious" value="1.427050,1.537060,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter proto="icmp"/>
        </slice>
        <from usec="0" sec="1323666174"/>
        <to usec="0" sec="1323666880"/>
    </anomaly>
    <anomaly type="suspicious" value="1.427050,1.537060,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter proto="icmp"/>
        </slice>
        <from usec="0" sec="1323666348"/>
        <to usec="0" sec="1323666350"/>
    </anomaly>
    <anomaly type="suspicious" value="1.096180,1.173690,999,0 0 0 1 1 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="152.93.115.161" dst_port="443"/>
            <filter src_ip="152.93.115.161" dst_ip="32.1.232.44" dst_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928302,1.176330,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1323666001"/>
        <to usec="0" sec="1323666289"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958125,1.173510,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="181.0.197.31" dst_ip="34.6.250.239" src_port="7490" dst_port="80"/>
            <filter src_ip="181.0.37.120" dst_ip="34.6.250.239" src_port="51263" dst_port="80"/>
        </slice>
        <from usec="0" sec="1323666001"/>
        <to usec="0" sec="1323666829"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958125,1.173510,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="177.219.211.41" dst_ip="14.143.151.140" src_port="55284" dst_port="39859"/>
            <filter src_ip="177.219.209.137" dst_ip="14.143.151.140" src_port="53087" dst_port="443"/>
        </slice>
        <from usec="0" sec="1323666061"/>
        <to usec="0" sec="1323666256"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958125,1.173510,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="216.235.53.28" dst_ip="177.219.213.178" src_port="80"/>
            <filter src_ip="216.235.55.96" dst_ip="177.219.213.178" src_port="80"/>
        </slice>
        <from usec="0" sec="1323666081"/>
        <to usec="0" sec="1323666257"/>
    </anomaly>
    <anomaly type="suspicious" value="1.096180,1.173690,999,0 0 0 1 1 0 0 0 0 1 0 0,ipv46tun">
        <slice>
            <filter src_ip="201.83.173.107" dst_ip="162.137.192.109"/>
            <filter src_ip="201.133.41.184" dst_ip="162.137.192.109"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958125,1.173510,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="214.142.60.166" dst_ip="154.219.34.89" src_port="443" dst_port="50402"/>
            <filter src_ip="214.142.60.166" dst_ip="200.51.21.128" src_port="443" dst_port="51408"/>
            <filter src_ip="214.142.60.166" dst_ip="152.93.0.56" src_port="443" dst_port="53668"/>
            <filter src_ip="214.142.60.166" dst_ip="200.63.164.142" src_port="443" dst_port="56644"/>
            <filter src_ip="214.142.60.166" dst_ip="200.63.165.128" src_port="443" dst_port="61916"/>
        </slice>
        <from usec="0" sec="1323666001"/>
        <to usec="0" sec="1323666442"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958125,1.173510,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="152.93.1.59" dst_ip="134.0.73.65" dst_port="80"/>
        </slice>
        <from usec="0" sec="1323666002"/>
        <to usec="0" sec="1323666829"/>
    </anomaly>
    <anomaly type="suspicious" value="0.757878,1.081100,999,0 0 0 1 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="177.219.82.123" src_port="53"/>
        </slice>
        <from usec="0" sec="1323666001"/>
        <to usec="0" sec="1323666109"/>
    </anomaly>
    <anomaly type="suspicious" value="0.757878,1.081100,999,0 0 0 1 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="201.83.162.211"/>
        </slice>
        <from usec="0" sec="1323666001"/>
        <to usec="0" sec="1323666227"/>
    </anomaly>
    <anomaly type="suspicious" value="0.757878,1.081100,010,0 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="201.83.162.210" dst_ip="214.59.75.239"/>
            <filter src_ip="201.83.162.210" dst_port="53"/>
            <filter src_ip="201.83.162.210" dst_port="80"/>
            <filter src_ip="201.83.162.211" dst_port="53"/>
            <filter src_ip="201.83.162.211" dst_port="80"/>
            <filter dst_ip="214.59.75.239" dst_port="53"/>
            <filter dst_ip="214.59.75.239" dst_port="80"/>
        </slice>
        <from usec="0" sec="1323666001"/>
        <to usec="0" sec="1323666467"/>
    </anomaly>
    <anomaly type="suspicious" value="0.757878,1.081100,999,0 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="177.219.180.6" dst_port="53"/>
            <filter dst_ip="17.255.35.75" dst_port="53"/>
        </slice>
        <from usec="0" sec="1323666001"/>
        <to usec="0" sec="1323666377"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="105.168.93.22" dst_port="445"/>
        </slice>
        <from usec="0" sec="1323666001"/>
        <to usec="0" sec="1323666047"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,010,0 0 0 0 0 0 1 1 1 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="177.219.9.163" dst_port="80"/>
        </slice>
        <from usec="0" sec="1323666001"/>
        <to usec="0" sec="1323666047"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.63.164.40" src_port="17445" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1323666001"/>
        <to usec="0" sec="1323666047"/>
    </anomaly>
    <anomaly type="suspicious" value="1.017520,1.170840,999,0 0 0 1 1 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="177.219.138.76" src_port="63444"/>
        </slice>
        <from usec="0" sec="1323666001"/>
        <to usec="0" sec="1323666379"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="145.214.37.117" src_port="80" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1323666631"/>
        <to usec="0" sec="1323666812"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="145.214.37.117" src_port="80" dst_port="3072"/>
        </slice>
        <from usec="0" sec="1323666631"/>
        <to usec="0" sec="1323666812"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065980,1.205650,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="177.219.196.238" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1323666001"/>
        <to usec="0" sec="1323666677"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="5.197.255.203" src_port="4076" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1323666631"/>
        <to usec="0" sec="1323666677"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065980,1.205650,010,0 0 0 1 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="201.83.162.210"/>
        </slice>
        <from usec="0" sec="1323666008"/>
        <to usec="0" sec="1323666767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,010,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="4935" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1323666631"/>
        <to usec="0" sec="1323666677"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="201.83.160.72" src_port="16790"/>
        </slice>
        <from usec="0" sec="1323666676"/>
        <to usec="0" sec="1323666722"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065980,1.205650,999,0 0 0 1 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="14.167.177.22" dst_ip="201.83.172.87" dst_port="53"/>
        </slice>
        <from usec="0" sec="1323666006"/>
        <to usec="0" sec="1323666812"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.83.162.217" dst_port="80"/>
            <filter dst_ip="201.83.162.217"/>
        </slice>
        <from usec="0" sec="1323666586"/>
        <to usec="0" sec="1323666767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="214.59.77.251" dst_port="53"/>
        </slice>
        <from usec="0" sec="1323666721"/>
        <to usec="0" sec="1323666767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="152.93.32.130" dst_port="53"/>
        </slice>
        <from usec="0" sec="1323666721"/>
        <to usec="0" sec="1323666767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="206.68.120.227" dst_ip="154.219.110.148" src_port="53"/>
            <filter src_ip="206.68.120.227" dst_ip="154.219.110.149" src_port="53"/>
        </slice>
        <from usec="0" sec="1323666001"/>
        <to usec="0" sec="1323666767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.3.189.43" dst_port="53"/>
        </slice>
        <from usec="0" sec="1323666586"/>
        <to usec="0" sec="1323666767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="5.42.68.207" dst_ip="177.219.180.6" src_port="53"/>
        </slice>
        <from usec="0" sec="1323666721"/>
        <to usec="0" sec="1323666767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,999,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="14.167.177.22" dst_ip="201.83.172.84" dst_port="53"/>
        </slice>
        <from usec="0" sec="1323666586"/>
        <to usec="0" sec="1323666767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="192.3.189.43" dst_ip="216.212.150.56" src_port="53"/>
        </slice>
        <from usec="0" sec="1323666721"/>
        <to usec="0" sec="1323666767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.83.168.113" src_port="53"/>
        </slice>
        <from usec="0" sec="1323666721"/>
        <to usec="0" sec="1323666767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039260,1.208400,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.63.182.48" dst_port="24498"/>
        </slice>
        <from usec="0" sec="1323666721"/>
        <to usec="0" sec="1323666767"/>
    </anomaly>
    <anomaly type="suspicious" value="0.716079,1.051940,503,0 0 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="216.212.130.2" src_port="80"/>
            <filter dst_ip="216.212.130.2" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.191600,1.205820,999,0 0 0 1 0 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="200.51.35.130" src_port="8080"/>
            <filter src_ip="200.51.35.130" dst_ip="196.228.225.102" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.186280,1.240120,504,1 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="177.219.136.10" dst_ip="29.182.155.196" src_port="54988" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.019200,1.121320,901,0 0 0 0 0 0 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="44.40.193.166" dst_ip="152.93.210.173" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.019200,1.121320,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="37.87.30.48" dst_ip="200.63.178.196" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958125,1.173510,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="181.0.20.61" src_port="53"/>
        </slice>
        <from usec="0" sec="1323666001"/>
        <to usec="0" sec="1323666468"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046440,1.118360,503,0 0 0 1 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="177.219.12.216" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.019200,1.121320,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="1.29.112.22" dst_ip="177.219.210.106" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.019200,1.121320,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="200.63.165.163" dst_ip="69.85.137.69" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.019200,1.121320,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="32.245.106.34" dst_ip="181.0.164.93" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.019200,1.121320,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="196.228.225.172" dst_ip="152.93.2.128" src_port="80"/>
            <filter src_ip="196.228.224.76" dst_ip="152.93.2.128" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.019200,1.121320,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="196.228.224.98" dst_ip="152.93.177.99" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.019200,1.121320,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="200.63.7.39" dst_ip="32.1.96.46" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.597210,1.989890,503,1 1 0 1 1 1 1 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="201.83.163.5" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.117580,1.896940,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="25.69.5.105" src_port="60621" dst_port="22"/>
        </slice>
        <from usec="0" sec="1323666146"/>
        <to usec="0" sec="1323666148"/>
    </anomaly>
    <anomaly type="anomalous" value="2.145110,1.895290,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="13.163.97.246" dst_port="23"/>
        </slice>
        <from usec="0" sec="1323666181"/>
        <to usec="0" sec="1323666227"/>
    </anomaly>
    <anomaly type="anomalous" value="2.117580,1.896940,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="172.20.32.73" src_port="2425" dst_port="2425"/>
        </slice>
        <from usec="0" sec="1323666603"/>
        <to usec="0" sec="1323666607"/>
    </anomaly>
    <anomaly type="anomalous" value="2.117580,1.896940,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="15.98.85.101" dst_port="23"/>
        </slice>
        <from usec="0" sec="1323666682"/>
        <to usec="0" sec="1323666685"/>
    </anomaly>
    <anomaly type="anomalous" value="2.117580,1.896940,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="13.161.106.19" dst_port="23"/>
        </slice>
        <from usec="0" sec="1323666765"/>
        <to usec="0" sec="1323666769"/>
    </anomaly>
    <anomaly type="anomalous" value="2.117580,1.896940,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="109.22.252.102" dst_port="23"/>
        </slice>
        <from usec="0" sec="1323666596"/>
        <to usec="0" sec="1323666600"/>
    </anomaly>
    <anomaly type="anomalous" value="2.197580,1.913370,010,1 1 1 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="37.110.129.205" dst_port="23"/>
        </slice>
        <from usec="0" sec="1323666001"/>
        <to usec="0" sec="1323666047"/>
    </anomaly>
    <anomaly type="anomalous" value="2.117580,1.896940,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.142.48.155" dst_port="23"/>
        </slice>
        <from usec="0" sec="1323666575"/>
        <to usec="0" sec="1323666578"/>
    </anomaly>
    <anomaly type="anomalous" value="2.255570,1.754280,503,0 0 0 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="201.83.163.5" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.044620,1.652300,504,0 0 0 1 1 1 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="217.202.132.132" dst_ip="152.93.143.146" src_port="443"/>
            <filter src_ip="136.138.150.28" dst_ip="152.93.143.146" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.007640,1.652530,999,1 0 0 1 1 1 1 1 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="201.83.13.91" src_port="58811"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.044620,1.652300,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="200.63.177.20" src_port="80"/>
            <filter dst_ip="200.63.177.20" src_port="17788"/>
            <filter dst_ip="200.63.177.20" dst_port="63868"/>
            <filter src_port="17788" dst_port="63868"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.134580,1.720700,011,1 1 0 1 1 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="201.83.169.116"/>
            <filter src_ip="200.63.184.83"/>
            <filter src_ip="201.83.169.101"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.243710,1.200060,999,0 0 0 1 1 0 1 1 0 1 0 0,ipv46tun">
        <slice>
            <filter src_ip="192.133.114.142"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.305080,1.782240,010,1 1 0 1 0 0 1 1 1 1 1 1,DDoSSYN">
        <slice>
            <filter dst_ip="201.83.169.116"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.452150,1.313370,999,0 0 0 1 1 0 1 1 1 1 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="74.223.27.87" dst_ip="201.83.160.72"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.487930,1.365440,010,1 0 0 1 1 0 1 1 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="201.83.169.101"/>
        </slice>
        <from usec="0" sec="1323666001"/>
        <to usec="0" sec="1323666812"/>
    </anomaly>
    <anomaly type="anomalous" value="1.452150,1.313370,503,0 0 0 1 1 0 1 1 1 1 0 0,ntscACK">
        <slice>
            <filter src_ip="201.83.160.72" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.255570,1.754280,999,0 0 0 1 1 1 1 1 1 1 1 1,mptpla">
        <slice>
            <filter src_ip="9.203.144.48" dst_ip="200.63.181.148"/>
            <filter src_ip="6.193.141.92" dst_ip="200.63.181.148"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.729910,1.388040,503,0 0 0 1 1 0 1 1 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="200.63.177.20" src_port="63868"/>
            <filter src_ip="200.63.177.20" dst_port="80"/>
            <filter src_ip="200.63.177.20" dst_port="17788"/>
            <filter src_port="63868" dst_port="17788"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.325140,1.932960,999,1 1 1 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="32.1.134.156" dst_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.399480,1.262180,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="152.93.55.231" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.379240,1.264800,502,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="201.83.172.76" dst_ip="192.241.129.148" src_port="53"/>
            <filter src_ip="201.83.175.119" dst_ip="192.241.129.148" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.953570,1.537920,010,1 0 0 1 0 0 1 1 1 1 1 1,DDoSSYN">
        <slice>
            <filter dst_ip="200.63.184.83"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.379240,1.264800,502,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="192.241.129.148" dst_ip="201.83.172.76" dst_port="53"/>
            <filter src_ip="192.241.129.148" dst_ip="201.83.175.119" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.662750,1.363000,503,0 0 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="201.83.173.2" src_port="80"/>
            <filter src_ip="201.83.163.54" src_port="80"/>
            <filter src_ip="201.83.163.52" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.255570,1.754280,999,0 0 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="201.83.166.8"/>
            <filter dst_port="21001"/>
            <filter src_ip="152.93.36.211" dst_ip="69.65.169.226" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.044620,1.652300,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="200.63.4.86" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.073120,1.650400,503,0 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="200.51.5.165" src_port="80"/>
            <filter dst_ip="200.51.5.165" src_port="53"/>
            <filter dst_ip="200.63.2.133" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.399480,1.262180,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="201.83.173.2" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.379240,1.264800,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="152.93.144.251" dst_ip="29.182.152.68" src_port="58408" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.379240,1.264800,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="177.197.139.74" src_port="80"/>
            <filter dst_ip="177.197.139.72" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.379240,1.264800,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="201.105.81.37" dst_ip="152.93.147.114" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.512650,2.020820,010,1 1 1 1 0 0 1 1 1 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="15.146.189.69" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.379240,1.264800,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="69.85.137.69" dst_ip="200.63.165.163" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.044620,1.652300,999,0 0 0 1 1 1 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="40.137.184.208"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.255570,1.754280,503,0 0 0 1 1 1 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="200.51.5.165" dst_port="80"/>
            <filter src_ip="200.51.5.165" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.255570,1.754280,503,0 0 0 1 1 1 1 1 1 1 1 1,ntscACK">
        <slice>
            <filter src_ip="200.63.2.133" dst_port="80"/>
            <filter src_ip="200.63.0.49" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
