<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.467300,1.101850,999,1 1 0 1 1 1 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="192.150.184.182" src_port="55688"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394887"/>
    </anomaly>
    <anomaly type="anomalous" value="1.157070,1.105880,999,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="192.150.29.177" dst_ip="163.154.56.80" src_port="5001" dst_port="47158"/>
        </slice>
        <from usec="0" sec="1325394014"/>
        <to usec="0" sec="1325394642"/>
    </anomaly>
    <anomaly type="anomalous" value="1.157070,1.105880,999,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.148.216.40" dst_ip="192.150.29.186" src_port="5001" dst_port="46041"/>
        </slice>
        <from usec="0" sec="1325394648"/>
        <to usec="0" sec="1325394654"/>
    </anomaly>
    <anomaly type="anomalous" value="1.141030,1.002850,999,1 1 1 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="54.63.168.203" src_port="5063" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1325394540"/>
        <to usec="0" sec="1325394586"/>
    </anomaly>
    <anomaly type="anomalous" value="1.115210,1.038000,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="130.166.137.81" src_port="5062" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1325394413"/>
        <to usec="0" sec="1325394721"/>
    </anomaly>
    <anomaly type="anomalous" value="1.157070,1.105880,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="34.154.182.8" dst_port="23"/>
        </slice>
        <from usec="0" sec="1325394430"/>
        <to usec="0" sec="1325394510"/>
    </anomaly>
    <anomaly type="anomalous" value="1.157070,1.105880,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="192.150.20.233" dst_ip="154.237.49.132" src_port="2733" dst_port="80"/>
        </slice>
        <from usec="0" sec="1325394507"/>
        <to usec="0" sec="1325394509"/>
    </anomaly>
    <anomaly type="anomalous" value="0.957587,0.889414,010,1 1 0 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="192.150.29.176"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394899"/>
    </anomaly>
    <anomaly type="anomalous" value="0.831595,0.825123,011,1 1 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="192.150.29.187"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394896"/>
    </anomaly>
    <anomaly type="anomalous" value="1.157070,1.105880,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="192.150.29.186" dst_ip="203.148.216.40" src_port="46041" dst_port="5001"/>
        </slice>
        <from usec="0" sec="1325394607"/>
        <to usec="0" sec="1325394666"/>
    </anomaly>
    <anomaly type="anomalous" value="1.673390,1.325220,999,1 1 1 1 1 1 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="193.118.232.119" src_port="62601"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394677"/>
    </anomaly>
    <anomaly type="anomalous" value="1.662330,1.240540,503,1 1 1 1 1 1 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="192.150.28.79" src_port="80"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394888"/>
    </anomaly>
    <anomaly type="anomalous" value="1.157070,1.105880,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="17.92.76.242" src_port="1433" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1325394011"/>
        <to usec="0" sec="1325394013"/>
    </anomaly>
    <anomaly type="anomalous" value="1.321130,1.088510,053,0 0 0 1 1 1 1 1 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="192.150.19.244" dst_ip="219.124.85.234" src_port="80"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394108"/>
    </anomaly>
    <anomaly type="anomalous" value="1.728810,1.284200,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="17.92.76.242" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394108"/>
    </anomaly>
    <anomaly type="anomalous" value="0.980806,0.855360,011,1 1 0 1 0 0 1 1 0 0 0 0,DDoSRSTrp">
        <slice>
            <filter src_ip="192.150.29.176"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394901"/>
    </anomaly>
    <anomaly type="anomalous" value="1.335020,1.184110,502,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="192.150.18.70" dst_ip="201.83.101.6" src_port="53"/>
            <filter src_ip="192.150.16.233" dst_ip="201.83.101.6" dst_port="22"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394828"/>
    </anomaly>
    <anomaly type="anomalous" value="1.235870,1.056380,010,1 1 1 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="192.150.20.109"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394901"/>
    </anomaly>
    <anomaly type="anomalous" value="1.253950,1.027870,011,1 1 1 1 0 0 1 1 0 0 0 0,DDoSRSTrp">
        <slice>
            <filter src_ip="192.150.20.109"/>
            <filter src_ip="192.150.20.115"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394900"/>
    </anomaly>
    <anomaly type="anomalous" value="1.335020,1.184110,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.128.183.220" dst_port="80"/>
        </slice>
        <from usec="0" sec="1325394002"/>
        <to usec="0" sec="1325394183"/>
    </anomaly>
    <anomaly type="anomalous" value="1.335020,1.184110,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="177.54.183.110" src_port="80"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394828"/>
    </anomaly>
    <anomaly type="anomalous" value="1.335020,1.184110,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="150.66.48.136" dst_ip="22.135.219.138" src_port="80" dst_port="56388"/>
        </slice>
        <from usec="0" sec="1325394588"/>
        <to usec="0" sec="1325394595"/>
    </anomaly>
    <anomaly type="anomalous" value="1.335020,1.184110,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="177.33.34.169" dst_ip="137.162.44.63" src_port="80"/>
            <filter src_ip="163.149.131.75" dst_ip="137.162.44.63" src_port="80"/>
        </slice>
        <from usec="0" sec="1325394003"/>
        <to usec="0" sec="1325394086"/>
    </anomaly>
    <anomaly type="anomalous" value="1.335020,1.184110,502,0 0 0 1 1 1 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="201.83.101.6" dst_ip="192.150.18.70" dst_port="53"/>
            <filter src_ip="201.83.101.6" dst_ip="192.150.16.233" src_port="22"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394468"/>
    </anomaly>
    <anomaly type="anomalous" value="1.141030,1.002850,999,1 1 1 0 0 0 1 1 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="201.11.213.239"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394543"/>
    </anomaly>
    <anomaly type="anomalous" value="1.321130,1.088510,999,0 0 0 1 1 1 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="193.118.235.166" src_port="16866"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394378"/>
    </anomaly>
    <anomaly type="anomalous" value="0.957149,0.889384,503,1 0 0 1 0 0 1 1 1 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="219.124.85.234" dst_ip="192.150.19.244" dst_port="80"/>
            <filter src_ip="219.124.85.237" dst_ip="192.150.19.244" dst_port="80"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394555"/>
    </anomaly>
    <anomaly type="anomalous" value="1.728810,1.284200,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="27.68.208.25" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1325394045"/>
        <to usec="0" sec="1325394091"/>
    </anomaly>
    <anomaly type="anomalous" value="0.957587,0.889414,020,1 1 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="133.140.225.58"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394535"/>
    </anomaly>
    <anomaly type="anomalous" value="1.221920,1.007070,999,1 0 0 1 1 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="193.118.232.119" dst_port="62601"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394828"/>
    </anomaly>
    <anomaly type="anomalous" value="0.957587,0.889414,503,1 1 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.150.28.103" dst_port="80"/>
        </slice>
        <from usec="0" sec="1325394090"/>
        <to usec="0" sec="1325394578"/>
    </anomaly>
    <anomaly type="anomalous" value="1.542200,1.150780,503,1 1 0 1 1 1 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.150.28.79" dst_port="80"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394648"/>
    </anomaly>
    <anomaly type="anomalous" value="1.728810,1.284200,502,1 1 1 1 1 1 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="7.21.214.23" dst_port="22"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.371750,1.078520,502,1 0 0 1 1 1 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="7.21.214.23" src_port="22"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394828"/>
    </anomaly>
    <anomaly type="anomalous" value="1.089680,0.917534,010,1 1 0 1 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="192.150.29.187"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394896"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739113,0.989493,999,0 0 0 0 0 0 0 0 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="54.63.168.203" src_port="5063" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1325394540"/>
        <to usec="0" sec="1325394586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.676131,0.920446,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="208.18.24.27" dst_ip="192.150.24.0" src_port="4441" dst_port="44450" proto="tcp"/>
        </slice>
        <from usec="0" sec="1325394668"/>
        <to usec="0" sec="1325394679"/>
    </anomaly>
    <anomaly type="suspicious" value="0.676131,0.920446,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="193.121.74.49" dst_ip="202.12.235.145" src_port="62063" dst_port="11024" proto="udp"/>
        </slice>
        <from usec="0" sec="1325394038"/>
        <to usec="0" sec="1325394509"/>
    </anomaly>
    <anomaly type="suspicious" value="0.676131,0.920446,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="150.66.171.56" dst_ip="60.140.212.68" src_port="3436" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1325394432"/>
        <to usec="0" sec="1325394509"/>
    </anomaly>
    <anomaly type="suspicious" value="0.676131,0.920446,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="192.150.28.65" dst_ip="205.15.3.124" src_port="26108" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1325394433"/>
        <to usec="0" sec="1325394435"/>
    </anomaly>
    <anomaly type="suspicious" value="0.676131,0.920446,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="150.66.169.78" dst_ip="37.166.116.57" src_port="51186" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1325394430"/>
        <to usec="0" sec="1325394506"/>
    </anomaly>
    <anomaly type="suspicious" value="0.676131,0.920446,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="150.66.219.177" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1325394430"/>
        <to usec="0" sec="1325394501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.676131,0.920446,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="154.224.62.51" dst_ip="150.66.219.177" src_port="80" dst_port="51210" proto="tcp"/>
        </slice>
        <from usec="0" sec="1325394027"/>
        <to usec="0" sec="1325394807"/>
    </anomaly>
    <anomaly type="suspicious" value="0.676131,0.920446,503,1 0 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="37.166.116.18" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1325394508"/>
        <to usec="0" sec="1325394510"/>
    </anomaly>
    <anomaly type="suspicious" value="0.676131,0.920446,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="46.111.25.139"/>
        </slice>
        <from usec="0" sec="1325394851"/>
        <to usec="0" sec="1325394859"/>
    </anomaly>
    <anomaly type="suspicious" value="0.853477,0.947675,999,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="204.58.116.119" dst_ip="192.150.29.186" src_port="5001" dst_port="50024"/>
        </slice>
        <from usec="0" sec="1325394656"/>
        <to usec="0" sec="1325394666"/>
    </anomaly>
    <anomaly type="suspicious" value="0.853477,0.947675,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="177.54.196.75" dst_ip="152.140.165.12" src_port="49699" dst_port="443"/>
        </slice>
        <from usec="0" sec="1325394353"/>
        <to usec="0" sec="1325394370"/>
    </anomaly>
    <anomaly type="suspicious" value="0.853477,0.947675,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="52.32.206.211" dst_ip="192.150.19.244" src_port="27407" dst_port="80"/>
        </slice>
        <from usec="0" sec="1325394068"/>
        <to usec="0" sec="1325394078"/>
    </anomaly>
    <anomaly type="suspicious" value="0.853477,0.947675,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="172.20.32.73" src_port="2425" dst_port="2425"/>
        </slice>
        <from usec="0" sec="1325394603"/>
        <to usec="0" sec="1325394606"/>
    </anomaly>
    <anomaly type="suspicious" value="0.853477,0.947675,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="135.8.215.40" dst_port="445"/>
        </slice>
        <from usec="0" sec="1325394055"/>
        <to usec="0" sec="1325394105"/>
    </anomaly>
    <anomaly type="suspicious" value="0.853477,0.947675,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="62.75.135.36" dst_port="445"/>
        </slice>
        <from usec="0" sec="1325394300"/>
        <to usec="0" sec="1325394369"/>
    </anomaly>
    <anomaly type="suspicious" value="0.853477,0.947675,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="28.139.78.54" dst_port="139"/>
        </slice>
        <from usec="0" sec="1325394568"/>
        <to usec="0" sec="1325394578"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768957,0.958999,999,0 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="38.33.21.187"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394108"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768957,0.958999,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="25.112.58.138"/>
        </slice>
        <from usec="0" sec="1325394002"/>
        <to usec="0" sec="1325394017"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768957,0.958999,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="193.120.13.167"/>
        </slice>
        <from usec="0" sec="1325394002"/>
        <to usec="0" sec="1325394108"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768957,0.958999,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="205.15.2.0"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394198"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768957,0.958999,503,0 0 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="38.33.21.178"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394790"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768957,0.958999,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="181.104.139.226"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394787"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768957,0.958999,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="150.66.68.8"/>
        </slice>
        <from usec="0" sec="1325394003"/>
        <to usec="0" sec="1325394826"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768957,0.958999,999,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="192.150.17.31"/>
        </slice>
        <from usec="0" sec="1325394712"/>
        <to usec="0" sec="1325394750"/>
    </anomaly>
    <anomaly type="suspicious" value="0.601689,0.837680,999,1 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="193.118.235.167" src_port="38716"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394671"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="193.118.1.155" dst_ip="216.3.163.133"/>
            <filter src_ip="193.118.1.155" dst_ip="70.215.23.40"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="193.118.11.61" src_port="24498"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394091"/>
    </anomaly>
    <anomaly type="suspicious" value="0.883089,0.901470,999,0 0 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="193.118.235.167" dst_port="38716"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,010,0 0 0 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="192.150.20.115"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394856"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.163.164.49" dst_port="53"/>
        </slice>
        <from usec="0" sec="1325394090"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.150.18.92" dst_port="53"/>
        </slice>
        <from usec="0" sec="1325394090"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="193.118.1.155" dst_port="19931"/>
            <filter dst_ip="193.118.1.155" dst_port="51987"/>
        </slice>
        <from usec="0" sec="1325394090"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.120.240.205" dst_port="53"/>
        </slice>
        <from usec="0" sec="1325394315"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,020,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="192.150.29.177"/>
        </slice>
        <from usec="0" sec="1325394315"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="192.150.30.86" dst_ip="125.171.119.216" dst_port="53"/>
        </slice>
        <from usec="0" sec="1325394315"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="192.150.29.186" dst_port="23269"/>
            <filter dst_ip="192.150.29.186"/>
        </slice>
        <from usec="0" sec="1325394315"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.150.28.119" dst_port="53"/>
        </slice>
        <from usec="0" sec="1325394315"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="27.2.85.221" dst_ip="192.150.28.65"/>
        </slice>
        <from usec="0" sec="1325394315"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="177.175.133.99" src_port="8090" dst_port="13828"/>
        </slice>
        <from usec="0" sec="1325394315"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,010,0 0 0 0 0 0 1 1 1 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="193.121.116.241" dst_ip="205.15.2.71" dst_port="80"/>
        </slice>
        <from usec="0" sec="1325394315"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="192.150.18.211"/>
        </slice>
        <from usec="0" sec="1325394315"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="193.118.11.61" dst_port="24498"/>
        </slice>
        <from usec="0" sec="1325394090"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.150.22.43" dst_port="53"/>
        </slice>
        <from usec="0" sec="1325394315"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="193.118.1.155" dst_ip="139.214.80.56"/>
        </slice>
        <from usec="0" sec="1325394315"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="193.118.1.155" dst_ip="139.214.80.56"/>
            <filter src_ip="193.118.1.155" dst_ip="216.3.163.133"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,010,0 0 0 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="192.150.29.187" dst_port="12416"/>
        </slice>
        <from usec="0" sec="1325394000"/>
        <to usec="0" sec="1325394046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.777521,0.952550,503,0 0 0 0 0 0 0 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="150.66.48.130" dst_port="80"/>
        </slice>
        <from usec="0" sec="1325394315"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671687,0.913007,999,0 0 0 0 0 0 1 0 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.150.18.88" dst_port="53"/>
        </slice>
        <from usec="0" sec="1325394090"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.713733,0.872833,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="193.118.1.155" dst_ip="216.3.163.133"/>
        </slice>
        <from usec="0" sec="1325394315"/>
        <to usec="0" sec="1325394361"/>
    </anomaly>
</admd:annotation>
