<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="3.630980,2.761240,999,1 1 1 1 1 1 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="201.218.39.91" src_port="62952"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751700"/>
    </anomaly>
    <anomaly type="anomalous" value="1.549680,1.344040,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="154.137.251.159" dst_port="22"/>
        </slice>
        <from usec="0" sec="1330751385"/>
        <to usec="0" sec="1330751582"/>
    </anomaly>
    <anomaly type="anomalous" value="2.150860,1.715010,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="119.190.173.3" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1330751346"/>
        <to usec="0" sec="1330751348"/>
    </anomaly>
    <anomaly type="anomalous" value="2.150860,1.715010,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="208.147.139.36" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1330750883"/>
        <to usec="0" sec="1330750885"/>
    </anomaly>
    <anomaly type="anomalous" value="2.150860,1.715010,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="208.147.139.54" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1330750882"/>
        <to usec="0" sec="1330750885"/>
    </anomaly>
    <anomaly type="anomalous" value="2.175060,1.698020,010,1 1 1 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="208.147.139.56" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330750846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.515520,1.365450,011,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="212.240.43.19" src_port="1433" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1330750985"/>
        <to usec="0" sec="1330750988"/>
    </anomaly>
    <anomaly type="anomalous" value="1.515520,1.365450,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="142.76.163.146" dst_port="80"/>
        </slice>
        <from usec="0" sec="1330751513"/>
        <to usec="0" sec="1330751569"/>
    </anomaly>
    <anomaly type="anomalous" value="2.175060,1.698020,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="208.147.139.26" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330750846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.230400,1.212210,999,1 0 0 1 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="200.204.181.144" dst_ip="10.0.0.7" src_port="53"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751421"/>
    </anomaly>
    <anomaly type="anomalous" value="1.806180,1.384000,011,1 1 0 1 1 0 1 1 0 0 0 0,DDoSRSTrp">
        <slice>
            <filter src_ip="201.218.179.135"/>
            <filter src_ip="201.218.179.147"/>
            <filter src_ip="201.218.184.65"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751699"/>
    </anomaly>
    <anomaly type="anomalous" value="2.103960,1.595260,503,1 1 0 1 1 1 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="201.218.185.44" src_port="80"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751697"/>
    </anomaly>
    <anomaly type="anomalous" value="1.540710,1.447300,503,0 0 0 1 1 1 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="201.218.180.178" src_port="80"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751623"/>
    </anomaly>
    <anomaly type="anomalous" value="3.630980,2.761240,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="104.130.187.63" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1330750801"/>
        <to usec="0" sec="1330751257"/>
    </anomaly>
    <anomaly type="anomalous" value="2.814170,2.331500,999,1 0 0 1 1 0 1 1 1 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="194.54.172.188"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751628"/>
    </anomaly>
    <anomaly type="anomalous" value="2.693890,1.937020,010,1 1 1 1 1 1 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="212.240.43.19" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751597"/>
    </anomaly>
    <anomaly type="anomalous" value="1.506350,1.467200,999,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="187.20.100.186" dst_ip="219.7.11.174" src_port="21"/>
            <filter src_ip="187.20.100.186" dst_ip="219.7.11.174" dst_port="40855"/>
        </slice>
        <from usec="0" sec="1330751546"/>
        <to usec="0" sec="1330751600"/>
    </anomaly>
    <anomaly type="anomalous" value="1.506350,1.467200,999,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="172.133.243.181" dst_ip="219.7.11.249" src_port="42680" dst_port="55597"/>
            <filter src_ip="172.133.243.181" dst_ip="219.7.11.249" src_port="21" dst_port="61066"/>
            <filter src_ip="142.76.160.38" dst_ip="219.7.11.249" src_port="80" dst_port="36995"/>
            <filter src_ip="172.133.43.60" dst_ip="219.7.11.249" src_port="443" dst_port="53954"/>
        </slice>
        <from usec="0" sec="1330750915"/>
        <to usec="0" sec="1330751085"/>
    </anomaly>
    <anomaly type="anomalous" value="1.506350,1.467200,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="172.133.131.100" dst_ip="83.3.184.50" src_port="80"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751358"/>
    </anomaly>
    <anomaly type="anomalous" value="1.506350,1.467200,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="142.76.163.152" dst_ip="116.194.233.190" src_port="80" dst_port="46938"/>
            <filter src_ip="142.76.163.152" dst_ip="116.194.233.190" src_port="80" dst_port="44300"/>
            <filter src_ip="201.218.185.30" dst_ip="116.194.233.190" src_port="80" dst_port="38602"/>
        </slice>
        <from usec="0" sec="1330751263"/>
        <to usec="0" sec="1330751309"/>
    </anomaly>
    <anomaly type="anomalous" value="1.506350,1.467200,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="187.20.2.227" dst_ip="83.3.190.197" src_port="80"/>
        </slice>
        <from usec="0" sec="1330750848"/>
        <to usec="0" sec="1330751434"/>
    </anomaly>
    <anomaly type="anomalous" value="1.506350,1.467200,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="172.159.136.110" src_port="80"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751628"/>
    </anomaly>
    <anomaly type="anomalous" value="1.506350,1.467200,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="187.20.10.107" dst_ip="219.7.11.54" src_port="80"/>
            <filter src_ip="171.94.159.13" dst_ip="219.7.11.54" src_port="443"/>
        </slice>
        <from usec="0" sec="1330750841"/>
        <to usec="0" sec="1330751302"/>
    </anomaly>
    <anomaly type="anomalous" value="2.287340,1.735980,010,1 1 1 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="33.80.188.203" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1330751025"/>
        <to usec="0" sec="1330751071"/>
    </anomaly>
    <anomaly type="anomalous" value="3.630980,2.761240,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="33.50.133.56" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1330751025"/>
        <to usec="0" sec="1330751071"/>
    </anomaly>
    <anomaly type="anomalous" value="1.277810,1.258920,503,1 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="142.76.163.155" dst_port="80"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751566"/>
    </anomaly>
    <anomaly type="anomalous" value="1.277810,1.258920,999,1 0 0 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="110.177.53.58" dst_ip="201.218.181.116"/>
            <filter src_ip="110.177.53.58" dst_port="53"/>
            <filter dst_ip="201.218.181.116" dst_port="53"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751656"/>
    </anomaly>
    <anomaly type="anomalous" value="2.219830,1.635620,503,1 1 0 1 1 1 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.218.185.44" dst_port="80"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751698"/>
    </anomaly>
    <anomaly type="anomalous" value="1.703680,1.391700,010,1 1 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="200.47.164.167" dst_ip="196.96.219.159" dst_port="80"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751570"/>
    </anomaly>
    <anomaly type="suspicious" value="1.013450,1.229840,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="200.35.167.92"/>
        </slice>
        <from usec="0" sec="1330751437"/>
        <to usec="0" sec="1330751439"/>
    </anomaly>
    <anomaly type="suspicious" value="1.013450,1.229840,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="91.168.203.110"/>
        </slice>
        <from usec="0" sec="1330751417"/>
        <to usec="0" sec="1330751421"/>
    </anomaly>
    <anomaly type="suspicious" value="1.013450,1.229840,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="142.76.163.168" dst_ip="178.133.118.63" src_port="80" dst_port="60488" proto="tcp"/>
        </slice>
        <from usec="0" sec="1330751557"/>
        <to usec="0" sec="1330751558"/>
    </anomaly>
    <anomaly type="suspicious" value="1.013450,1.229840,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="64.34.126.190" dst_ip="142.76.70.116" proto="udp"/>
        </slice>
        <from usec="0" sec="1330751417"/>
        <to usec="0" sec="1330751421"/>
    </anomaly>
    <anomaly type="suspicious" value="1.013450,1.229840,999,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="200.47.130.131"/>
        </slice>
        <from usec="0" sec="1330751557"/>
        <to usec="0" sec="1330751559"/>
    </anomaly>
    <anomaly type="suspicious" value="1.181020,1.284830,503,0 1 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="200.47.164.2" dst_port="80"/>
        </slice>
        <from usec="0" sec="1330750811"/>
        <to usec="0" sec="1330751423"/>
    </anomaly>
    <anomaly type="suspicious" value="1.006410,1.157190,503,1 0 0 1 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="200.47.164.2" dst_port="80"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751425"/>
    </anomaly>
    <anomaly type="suspicious" value="0.952984,1.181990,503,1 0 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="142.76.163.146" src_port="80"/>
        </slice>
        <from usec="0" sec="1330750852"/>
        <to usec="0" sec="1330751691"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841674,1.155370,999,0 0 0 1 1 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="201.218.179.75" src_port="51413"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751441"/>
    </anomaly>
    <anomaly type="suspicious" value="1.099750,1.210480,010,0 0 0 1 1 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.218.179.147"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751656"/>
    </anomaly>
    <anomaly type="suspicious" value="0.850073,1.228130,503,0 0 0 0 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="83.3.184.152"/>
        </slice>
        <from usec="0" sec="1330750805"/>
        <to usec="0" sec="1330751264"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841674,1.155370,010,0 0 0 1 1 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="41.100.106.190" src_port="80"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751527"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="172.159.21.61" dst_ip="98.14.139.139" src_port="123"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751116"/>
    </anomaly>
    <anomaly type="suspicious" value="1.099750,1.210480,010,0 0 0 1 1 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="201.218.179.1" dst_port="61963"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751566"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,010,0 0 0 0 0 0 1 1 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="201.218.184.65"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751566"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854858,1.170990,503,0 0 0 1 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="142.76.163.152" dst_port="80"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,010,0 0 0 0 0 0 1 1 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="201.218.179.135"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751656"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854858,1.170990,503,0 0 0 1 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.218.185.30" dst_port="80"/>
        </slice>
        <from usec="0" sec="1330750800"/>
        <to usec="0" sec="1330751358"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="201.218.184.64" dst_port="53"/>
            <filter dst_ip="201.218.184.64"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751566"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="194.96.20.100" dst_port="53"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751566"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,010,0 0 0 0 0 0 1 1 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="201.218.184.75"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751566"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.218.185.2" dst_port="53"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751566"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="101.114.42.197" dst_ip="201.218.185.34"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751566"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.35.51.44" dst_port="27745"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751566"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.218.180.178" dst_port="80"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751566"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,020,0 0 0 0 0 0 1 1 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="201.218.180.227"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751566"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="172.153.69.147" src_port="53"/>
            <filter dst_ip="172.153.69.147" dst_port="53"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="201.218.184.74"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="204.241.7.103" dst_ip="140.230.244.101" src_port="53"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751566"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,504,0 0 0 0 0 0 1 1 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="142.76.71.245" dst_ip="105.120.26.184" dst_port="443"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.218.181.112" dst_port="53"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.218.181.118" dst_port="53"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.218.185.28" dst_port="80"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="172.159.21.61" dst_ip="202.221.6.54" src_port="123"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="176.73.7.217" dst_port="14961"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="154.81.102.174" dst_ip="172.159.21.61" dst_port="123"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="201.218.179.20" dst_port="45044"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.218.176.239" dst_port="53"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.35.52.187" dst_port="53"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921784,1.219270,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="201.218.179.75" dst_port="51413"/>
        </slice>
        <from usec="0" sec="1330751070"/>
        <to usec="0" sec="1330751116"/>
    </anomaly>
</admd:annotation>
