<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="0.983249,1.106400,010,0 0 0 0 0 0 0 0 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="51.46.210.87" src_port="13879" dst_port="22"/>
        </slice>
        <from usec="0" sec="1328159520"/>
        <to usec="0" sec="1328159566"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="204.25.143.164" dst_ip="216.129.37.238" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1328159418"/>
        <to usec="0" sec="1328159496"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter proto="icmp"/>
        </slice>
        <from usec="0" sec="1328158804"/>
        <to usec="0" sec="1328159700"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="37.135.77.188" dst_ip="205.79.108.44" src_port="54338" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1328159494"/>
        <to usec="0" sec="1328159551"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="204.25.138.224" dst_ip="219.79.10.151" src_port="55116" dst_port="25" proto="tcp"/>
        </slice>
        <from usec="0" sec="1328159494"/>
        <to usec="0" sec="1328159496"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="204.25.137.233" dst_ip="175.219.211.39" src_port="16279" dst_port="1041" proto="tcp"/>
        </slice>
        <from usec="0" sec="1328158838"/>
        <to usec="0" sec="1328159551"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="205.79.107.13"/>
        </slice>
        <from usec="0" sec="1328159421"/>
        <to usec="0" sec="1328159423"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="161.241.89.10" dst_ip="40.2.7.147" src_port="55956" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1328158838"/>
        <to usec="0" sec="1328159549"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="161.241.101.164" dst_ip="40.155.14.16" dst_port="25" proto="tcp"/>
        </slice>
        <from usec="0" sec="1328159428"/>
        <to usec="0" sec="1328159450"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="204.25.51.138" dst_ip="40.155.170.175" src_port="50900" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1328159494"/>
        <to usec="0" sec="1328159496"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="205.79.108.216" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1328159418"/>
        <to usec="0" sec="1328159496"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="145.20.64.116" dst_ip="66.123.90.139" src_port="65504" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1328158981"/>
        <to usec="0" sec="1328158983"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="36.151.79.78" dst_ip="151.145.72.164" src_port="80" dst_port="1359" proto="tcp"/>
        </slice>
        <from usec="0" sec="1328159374"/>
        <to usec="0" sec="1328159378"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="204.25.141.184" dst_ip="11.189.139.83" src_port="52799" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1328159421"/>
        <to usec="0" sec="1328159497"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="214.194.19.194" dst_ip="161.241.15.124" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1328159012"/>
        <to usec="0" sec="1328159014"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter proto="icmp"/>
        </slice>
        <from usec="0" sec="1328159158"/>
        <to usec="0" sec="1328159437"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="153.2.51.199" dst_ip="153.2.51.199" src_port="50470" proto="tcp"/>
        </slice>
        <from usec="0" sec="1328159374"/>
        <to usec="0" sec="1328159429"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="145.20.203.5" dst_ip="40.2.7.180" dst_port="1935"/>
        </slice>
        <from usec="0" sec="1328159369"/>
        <to usec="0" sec="1328159429"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,504,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="204.18.149.160" src_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1328159522"/>
        <to usec="0" sec="1328159524"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="204.25.49.68" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1328159458"/>
        <to usec="0" sec="1328159459"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="205.113.53.206" dst_port="23"/>
        </slice>
        <from usec="0" sec="1328159375"/>
        <to usec="0" sec="1328159473"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="26.165.44.45" dst_port="139" proto="tcp"/>
        </slice>
        <from usec="0" sec="1328159186"/>
        <to usec="0" sec="1328159190"/>
    </anomaly>
    <anomaly type="suspicious" value="0.857438,1.003460,999,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="204.25.137.233"/>
        </slice>
        <from usec="0" sec="1328159418"/>
        <to usec="0" sec="1328159420"/>
    </anomaly>
    <anomaly type="suspicious" value="1.079700,1.111440,999,1 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="205.79.163.143" src_port="56155"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159379"/>
    </anomaly>
    <anomaly type="suspicious" value="1.079700,1.111440,999,1 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="205.79.180.183" src_port="57414"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,503,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="145.20.136.166" dst_port="80"/>
            <filter dst_ip="172.210.216.97" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159178"/>
    </anomaly>
    <anomaly type="suspicious" value="1.079700,1.111440,503,1 0 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="205.79.100.246" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159551"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="161.241.12.165" dst_ip="76.110.182.157" src_port="80"/>
        </slice>
        <from usec="0" sec="1328158809"/>
        <to usec="0" sec="1328159211"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,999,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="145.20.96.120" dst_port="53"/>
            <filter dst_ip="200.212.92.52" dst_port="53"/>
            <filter dst_ip="34.22.210.19" dst_port="53"/>
        </slice>
        <from usec="0" sec="1328158801"/>
        <to usec="0" sec="1328159621"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,503,0 0 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="40.155.145.33" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159626"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913718,1.068090,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159358"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="203.147.214.92" dst_ip="204.25.142.74" src_port="80"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328158908"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="205.79.100.246" dst_ip="17.131.226.143" src_port="80" dst_port="3124"/>
            <filter src_ip="205.79.100.246" dst_ip="17.131.226.143" src_port="80" dst_port="3123"/>
        </slice>
        <from usec="0" sec="1328158916"/>
        <to usec="0" sec="1328158924"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="192.89.215.103" dst_ip="205.79.96.148" src_port="45002" dst_port="45430"/>
            <filter src_ip="192.89.215.103" dst_ip="205.79.96.148" src_port="12865" dst_port="52591"/>
        </slice>
        <from usec="0" sec="1328158965"/>
        <to usec="0" sec="1328158977"/>
    </anomaly>
    <anomaly type="suspicious" value="1.492930,1.529540,503,0 0 0 1 0 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="218.156.57.197" dst_ip="204.25.141.184" src_port="80"/>
            <filter src_ip="74.130.193.104" dst_ip="204.25.141.184" src_port="80"/>
        </slice>
        <from usec="0" sec="1328158851"/>
        <to usec="0" sec="1328159049"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,504,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="40.155.65.226" dst_port="80"/>
            <filter dst_ip="40.155.65.226" dst_port="443"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159178"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,999,0 0 0 1 1 0 0 0 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="192.7.67.48" dst_ip="39.176.70.24"/>
        </slice>
        <from usec="0" sec="1328158801"/>
        <to usec="0" sec="1328159172"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="161.241.233.149" dst_ip="29.87.108.16" src_port="50088" dst_port="443"/>
            <filter src_ip="161.241.233.149" dst_ip="29.87.108.16" src_port="50083" dst_port="443"/>
            <filter src_ip="161.241.233.149" dst_ip="29.87.108.16" src_port="50066" dst_port="443"/>
            <filter src_ip="161.241.133.84" dst_ip="29.87.108.16" src_port="25058" dst_port="443"/>
            <filter src_ip="145.20.136.205" dst_ip="29.87.108.16" src_port="56577" dst_port="443"/>
        </slice>
        <from usec="0" sec="1328158848"/>
        <to usec="0" sec="1328159172"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="205.79.106.128" dst_ip="75.115.85.94" src_port="7189" dst_port="54076"/>
            <filter src_ip="205.79.106.128" dst_ip="75.115.85.94" src_port="7189" dst_port="54072"/>
            <filter src_ip="205.79.106.128" dst_ip="75.115.85.94" src_port="7189" dst_port="54063"/>
            <filter src_ip="205.79.106.128" dst_ip="75.115.85.94" src_port="7189" dst_port="54059"/>
        </slice>
        <from usec="0" sec="1328158976"/>
        <to usec="0" sec="1328159167"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="161.241.212.203" dst_ip="38.65.136.60" src_port="65296" dst_port="80"/>
            <filter src_ip="161.241.212.203" dst_ip="38.65.136.60" src_port="65295" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328159089"/>
        <to usec="0" sec="1328159124"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,503,0 0 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="172.210.216.114" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328158802"/>
        <to usec="0" sec="1328159260"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,503,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter src_ip="118.15.124.170" dst_ip="161.241.165.51"/>
            <filter src_ip="118.15.124.170" src_port="443"/>
            <filter dst_ip="161.241.165.51" dst_port="4371"/>
            <filter src_ip="132.164.208.91" dst_ip="161.241.165.51" src_port="443"/>
        </slice>
        <from usec="0" sec="1328158821"/>
        <to usec="0" sec="1328159268"/>
    </anomaly>
    <anomaly type="suspicious" value="1.079700,1.111440,503,1 0 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="205.79.108.216" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,504,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="145.241.130.92" dst_port="443"/>
            <filter src_ip="145.241.130.92" dst_ip="196.139.88.68" dst_port="80"/>
            <filter src_ip="145.241.130.157" dst_ip="196.139.88.68" dst_port="443"/>
        </slice>
        <from usec="0" sec="1328158875"/>
        <to usec="0" sec="1328159508"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="145.1.138.51" dst_ip="13.162.72.26" src_port="57023" dst_port="29668"/>
        </slice>
        <from usec="0" sec="1328159432"/>
        <to usec="0" sec="1328159538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,999,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="205.79.106.204" dst_port="61963"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="40.155.145.4" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328158802"/>
        <to usec="0" sec="1328159625"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="6.53.186.66" dst_ip="151.145.182.134" src_port="80"/>
            <filter src_ip="6.53.186.26" dst_ip="151.145.182.134" src_port="80"/>
            <filter src_ip="6.53.186.83" dst_ip="151.145.182.134" src_port="80"/>
            <filter src_ip="6.53.186.112" dst_ip="151.145.182.134" src_port="80"/>
        </slice>
        <from usec="0" sec="1328158980"/>
        <to usec="0" sec="1328159589"/>
    </anomaly>
    <anomaly type="suspicious" value="0.827721,1.040060,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="161.241.91.133" dst_ip="66.123.92.207" dst_port="443"/>
        </slice>
        <from usec="0" sec="1328159488"/>
        <to usec="0" sec="1328159610"/>
    </anomaly>
    <anomaly type="suspicious" value="1.542270,1.548740,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159358"/>
    </anomaly>
    <anomaly type="suspicious" value="0.913718,1.068090,503,0 0 0 0 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="218.156.57.197" dst_ip="204.25.141.184" src_port="80"/>
            <filter src_ip="74.130.193.104" dst_ip="204.25.141.184" src_port="80"/>
        </slice>
        <from usec="0" sec="1328158851"/>
        <to usec="0" sec="1328159049"/>
    </anomaly>
    <anomaly type="suspicious" value="0.690738,0.944847,011,0 0 0 1 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="205.79.101.66"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791756,0.975618,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.241.101.75"/>
        </slice>
        <from usec="0" sec="1328159115"/>
        <to usec="0" sec="1328159161"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791756,0.975618,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="205.79.108.236"/>
        </slice>
        <from usec="0" sec="1328159115"/>
        <to usec="0" sec="1328159161"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791756,0.975618,010,0 0 0 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_port="4935" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1328159340"/>
        <to usec="0" sec="1328159386"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791756,0.975618,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="161.241.15.124" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="suspicious" value="0.690738,0.944847,504,0 0 0 1 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="40.155.145.40" dst_port="443"/>
        </slice>
        <from usec="0" sec="1328158816"/>
        <to usec="0" sec="1328159621"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791756,0.975618,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="204.18.164.194" dst_port="53"/>
        </slice>
        <from usec="0" sec="1328159475"/>
        <to usec="0" sec="1328159521"/>
    </anomaly>
    <anomaly type="anomalous" value="1.052380,1.051390,503,1 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="204.18.164.194" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328159396"/>
        <to usec="0" sec="1328159521"/>
    </anomaly>
    <anomaly type="anomalous" value="1.351420,1.237420,504,1 1 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="40.16.58.56" dst_port="443"/>
            <filter src_ip="151.145.173.94" dst_ip="40.16.58.12" dst_port="443"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159628"/>
    </anomaly>
    <anomaly type="anomalous" value="2.324590,1.772500,503,1 1 1 1 1 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="204.25.141.12" dst_port="80"/>
            <filter src_ip="204.25.141.12" dst_port="443"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159628"/>
    </anomaly>
    <anomaly type="anomalous" value="2.216630,1.852030,503,1 0 0 1 1 1 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="205.79.100.202" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159677"/>
    </anomaly>
    <anomaly type="anomalous" value="1.222890,1.198630,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter proto="icmp"/>
        </slice>
        <from usec="0" sec="1328158804"/>
        <to usec="0" sec="1328159697"/>
    </anomaly>
    <anomaly type="anomalous" value="1.788780,1.484870,503,1 1 1 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="161.241.15.114" src_port="80"/>
        </slice>
        <from usec="0" sec="1328159538"/>
        <to usec="0" sec="1328159628"/>
    </anomaly>
    <anomaly type="anomalous" value="2.429830,2.009370,503,1 1 1 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="205.79.100.202" src_port="80"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159698"/>
    </anomaly>
    <anomaly type="anomalous" value="1.222890,1.198630,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter proto="icmp"/>
        </slice>
        <from usec="0" sec="1328159158"/>
        <to usec="0" sec="1328159437"/>
    </anomaly>
    <anomaly type="anomalous" value="1.933630,1.544340,503,1 1 1 1 0 0 0 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="161.241.15.114" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159496"/>
    </anomaly>
    <anomaly type="anomalous" value="2.230060,1.706860,020,1 1 1 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="87.112.98.92"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159521"/>
    </anomaly>
    <anomaly type="anomalous" value="1.830170,1.504640,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="210.99.120.140" src_port="80"/>
        </slice>
        <from usec="0" sec="1328159078"/>
        <to usec="0" sec="1328159080"/>
    </anomaly>
    <anomaly type="anomalous" value="1.830170,1.504640,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="204.79.172.191" dst_port="23"/>
        </slice>
        <from usec="0" sec="1328158883"/>
        <to usec="0" sec="1328158885"/>
    </anomaly>
    <anomaly type="anomalous" value="1.830170,1.504640,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="40.211.237.169" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328158834"/>
        <to usec="0" sec="1328158840"/>
    </anomaly>
    <anomaly type="anomalous" value="1.405740,1.261070,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="178.50.230.15" dst_port="445"/>
            <filter src_ip="178.50.230.15" dst_port="139"/>
        </slice>
        <from usec="0" sec="1328158969"/>
        <to usec="0" sec="1328159016"/>
    </anomaly>
    <anomaly type="anomalous" value="1.275920,1.235700,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter proto="icmp"/>
        </slice>
        <from usec="0" sec="1328158850"/>
        <to usec="0" sec="1328159635"/>
    </anomaly>
    <anomaly type="anomalous" value="1.830170,1.504640,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.249.201.229" src_port="63205" dst_port="443"/>
        </slice>
        <from usec="0" sec="1328159368"/>
        <to usec="0" sec="1328159409"/>
    </anomaly>
    <anomaly type="anomalous" value="1.275920,1.235700,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter proto="icmp"/>
        </slice>
        <from usec="0" sec="1328159158"/>
        <to usec="0" sec="1328159437"/>
    </anomaly>
    <anomaly type="anomalous" value="1.830170,1.504640,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="51.46.210.87" src_port="22" dst_port="13879"/>
        </slice>
        <from usec="0" sec="1328159495"/>
        <to usec="0" sec="1328159550"/>
    </anomaly>
    <anomaly type="anomalous" value="2.037730,1.609600,011,1 1 1 1 1 0 1 0 0 0 0 0,DDoSRSTrp">
        <slice>
            <filter src_ip="205.79.106.111"/>
            <filter src_ip="205.79.106.117"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159701"/>
    </anomaly>
    <anomaly type="anomalous" value="1.676060,1.620790,502,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="205.79.109.50" dst_ip="192.89.215.103" src_port="53"/>
            <filter src_ip="205.79.110.234" dst_ip="192.89.215.103" dst_port="22"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328158998"/>
    </anomaly>
    <anomaly type="anomalous" value="1.676060,1.620790,053,0 0 0 1 1 1 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="205.79.108.44" dst_ip="24.188.29.28" src_port="80"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159538"/>
    </anomaly>
    <anomaly type="anomalous" value="1.676060,1.620790,503,0 0 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="205.79.100.244" src_port="80"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159268"/>
    </anomaly>
    <anomaly type="anomalous" value="1.676060,1.620790,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="204.25.141.12" src_port="80"/>
            <filter dst_ip="204.25.141.12" src_port="443"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159628"/>
    </anomaly>
    <anomaly type="anomalous" value="1.223480,1.107470,504,1 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="204.25.142.131"/>
            <filter dst_port="443"/>
            <filter dst_ip="40.155.65.222" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159437"/>
    </anomaly>
    <anomaly type="anomalous" value="2.324590,1.772500,999,1 1 1 1 1 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="204.18.139.129" src_port="8080"/>
            <filter src_ip="204.18.139.129" dst_ip="196.166.38.75" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159628"/>
    </anomaly>
    <anomaly type="anomalous" value="2.037730,1.609600,010,1 1 1 1 1 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="206.84.43.165" src_port="43731" dst_port="10000"/>
        </slice>
        <from usec="0" sec="1328159430"/>
        <to usec="0" sec="1328159521"/>
    </anomaly>
    <anomaly type="anomalous" value="2.324590,1.772500,503,1 1 1 1 1 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="204.18.139.52" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159628"/>
    </anomaly>
    <anomaly type="anomalous" value="1.676060,1.620790,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="205.79.108.128" dst_ip="166.115.21.144" src_port="80"/>
            <filter src_ip="205.79.108.128" dst_ip="192.88.158.151" src_port="80"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159358"/>
    </anomaly>
    <anomaly type="anomalous" value="2.743680,2.164950,010,1 1 1 1 1 1 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="205.79.106.111"/>
            <filter dst_ip="205.79.106.117"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159700"/>
    </anomaly>
    <anomaly type="anomalous" value="1.314720,1.201540,999,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="75.98.41.34" src_port="53"/>
            <filter dst_ip="145.20.48.209" src_port="53"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328159538"/>
    </anomaly>
    <anomaly type="anomalous" value="2.064210,1.594550,011,1 1 1 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="58.249.201.229" src_port="443" dst_port="63205"/>
        </slice>
        <from usec="0" sec="1328159368"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.314720,1.201540,503,0 0 0 1 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="204.18.164.194" src_port="80"/>
            <filter dst_ip="204.18.164.194" src_port="53"/>
        </slice>
        <from usec="0" sec="1328158805"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.535860,1.287000,053,1 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="6.80.178.237" dst_ip="151.145.172.32" src_port="80"/>
        </slice>
        <from usec="0" sec="1328159363"/>
        <to usec="0" sec="1328159523"/>
    </anomaly>
    <anomaly type="anomalous" value="2.064210,1.594550,010,1 1 1 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.112.98.92" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159521"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,010,0 0 0 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="205.79.106.117"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="205.79.109.45" dst_port="53"/>
        </slice>
        <from usec="0" sec="1328159115"/>
        <to usec="0" sec="1328159476"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="205.79.109.41" src_port="53"/>
            <filter dst_ip="205.79.109.41" dst_port="53"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="2.610660,2.077550,010,1 1 1 1 1 1 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="51.46.210.87" src_port="13879" dst_port="22"/>
        </slice>
        <from usec="0" sec="1328159475"/>
        <to usec="0" sec="1328159570"/>
    </anomaly>
    <anomaly type="anomalous" value="1.079830,1.063950,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="205.79.101.67" dst_port="53"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328158846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.079830,1.063950,010,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="205.79.101.67" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328158800"/>
        <to usec="0" sec="1328158846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,020,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="205.79.101.67"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,010,0 0 0 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="205.79.101.79"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.314720,1.201540,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="205.79.101.78" dst_port="23269"/>
        </slice>
        <from usec="0" sec="1328158815"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="204.25.42.154" src_port="53"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="203.181.133.129" dst_ip="162.43.30.112" src_port="53"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="162.43.30.113" src_port="53"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="161.241.15.127" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.241.40.234" src_port="53"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="205.79.109.70"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="6.53.176.53" dst_ip="145.5.76.59" src_port="80"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="12.70.52.80" dst_ip="145.5.76.56" src_port="80"/>
            <filter src_ip="6.53.186.14" dst_ip="145.5.76.56" src_port="443"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="205.79.102.8" dst_port="7518"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="205.79.100.244" dst_port="80"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="145.20.89.65" dst_ip="206.184.244.55" src_port="123"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.079830,1.063950,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="204.25.142.67" src_port="53"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="204.141.234.224" dst_ip="10.5.115.115" src_port="53"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.079830,1.063950,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="42.140.63.153" dst_port="80"/>
            <filter dst_ip="42.140.63.153" dst_port="443"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="204.25.42.112" dst_port="53"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="205.79.106.184" dst_port="51413"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="145.197.122.187" src_port="53"/>
            <filter dst_ip="145.197.122.187" dst_port="53"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.370490,1.225880,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="205.79.100.225" dst_port="53"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.227170,1.185030,999,0 0 0 0 0 0 0 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="162.43.8.140" dst_port="29991"/>
        </slice>
        <from usec="0" sec="1328159385"/>
        <to usec="0" sec="1328159431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.164550,1.159820,999,0 0 0 1 0 0 0 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="42.140.63.41" dst_port="5222"/>
        </slice>
        <from usec="0" sec="1328158810"/>
        <to usec="0" sec="1328159627"/>
    </anomaly>
</admd:annotation>
