<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.042160,0.902731,502,1 1 1 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="8.235.59.200" dst_ip="206.41.252.2" src_port="59474" dst_port="22"/>
            <filter src_ip="8.235.59.200" dst_ip="206.41.252.2" src_port="22" dst_port="38447"/>
            <filter src_ip="198.199.121.152" dst_ip="206.41.252.2" src_port="80" dst_port="54364"/>
            <filter src_ip="12.164.224.138" dst_ip="206.41.252.2" src_port="60933" dst_port="22"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333516457"/>
    </anomaly>
    <anomaly type="anomalous" value="0.954641,0.887284,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="207.237.144.190" dst_ip="198.209.3.72" src_port="45793" dst_port="80"/>
        </slice>
        <from usec="0" sec="1333515789"/>
        <to usec="0" sec="1333516302"/>
    </anomaly>
    <anomaly type="anomalous" value="1.365790,1.079120,503,1 1 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="183.11.77.80" dst_ip="44.67.5.220" src_port="80"/>
            <filter src_ip="183.11.77.80" dst_ip="209.132.169.118" src_port="80"/>
            <filter src_ip="183.11.77.80" dst_ip="44.67.5.118" src_port="80"/>
        </slice>
        <from usec="0" sec="1333515635"/>
        <to usec="0" sec="1333516436"/>
    </anomaly>
    <anomaly type="anomalous" value="1.365790,1.079120,503,1 1 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="206.41.247.63" dst_ip="209.132.169.58" src_port="80" dst_port="46352"/>
            <filter src_ip="136.209.136.48" dst_ip="209.132.169.58" src_port="80" dst_port="46624"/>
        </slice>
        <from usec="0" sec="1333515684"/>
        <to usec="0" sec="1333515743"/>
    </anomaly>
    <anomaly type="anomalous" value="1.042160,0.902731,503,1 1 1 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="207.226.33.74" dst_port="80"/>
            <filter src_ip="207.226.33.74" dst_port="53"/>
        </slice>
        <from usec="0" sec="1333515602"/>
        <to usec="0" sec="1333516458"/>
    </anomaly>
    <anomaly type="anomalous" value="0.954641,0.887284,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="217.18.162.172" src_port="2374" dst_port="80"/>
        </slice>
        <from usec="0" sec="1333515727"/>
        <to usec="0" sec="1333515729"/>
    </anomaly>
    <anomaly type="anomalous" value="0.954641,0.887284,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="183.11.34.31" dst_ip="44.67.5.139" src_port="80"/>
        </slice>
        <from usec="0" sec="1333515603"/>
        <to usec="0" sec="1333516501"/>
    </anomaly>
    <anomaly type="anomalous" value="1.365790,1.079120,503,1 1 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.41.250.1" dst_port="80"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333516480"/>
    </anomaly>
    <anomaly type="anomalous" value="0.746900,0.703531,503,1 1 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="8.179.171.68" dst_port="80"/>
            <filter dst_ip="8.179.171.70" dst_port="80"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333516300"/>
    </anomaly>
    <anomaly type="anomalous" value="1.042160,0.902731,999,1 1 1 1 0 0 0 0 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="196.120.79.39"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333516431"/>
    </anomaly>
    <anomaly type="anomalous" value="0.954641,0.887284,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="60.174.171.2"/>
        </slice>
        <from usec="0" sec="1333516430"/>
        <to usec="0" sec="1333516433"/>
    </anomaly>
    <anomaly type="anomalous" value="0.954641,0.887284,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="65.181.85.208" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1333516012"/>
        <to usec="0" sec="1333516015"/>
    </anomaly>
    <anomaly type="anomalous" value="0.954641,0.887284,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="11.85.100.26" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="1333516103"/>
        <to usec="0" sec="1333516104"/>
    </anomaly>
    <anomaly type="anomalous" value="0.954641,0.887284,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="206.232.32.185" src_port="11971" dst_port="22"/>
        </slice>
        <from usec="0" sec="1333516456"/>
        <to usec="0" sec="1333516458"/>
    </anomaly>
    <anomaly type="anomalous" value="0.954641,0.887284,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="12.112.178.82" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1333516285"/>
        <to usec="0" sec="1333516288"/>
    </anomaly>
    <anomaly type="anomalous" value="0.954641,0.887284,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="84.10.22.13" dst_port="8080"/>
            <filter src_ip="84.10.22.13" dst_port="80"/>
        </slice>
        <from usec="0" sec="1333515710"/>
        <to usec="0" sec="1333515714"/>
    </anomaly>
    <anomaly type="anomalous" value="0.954641,0.887284,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="60.174.171.2" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1333516430"/>
        <to usec="0" sec="1333516433"/>
    </anomaly>
    <anomaly type="anomalous" value="0.954641,0.887284,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="136.17.200.26" dst_port="23"/>
        </slice>
        <from usec="0" sec="1333515789"/>
        <to usec="0" sec="1333515791"/>
    </anomaly>
    <anomaly type="anomalous" value="1.135310,1.070930,010,1 1 1 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="54.160.160.45" dst_port="22"/>
        </slice>
        <from usec="0" sec="1333515826"/>
        <to usec="0" sec="1333516105"/>
    </anomaly>
    <anomaly type="anomalous" value="0.954641,0.887284,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="156.236.88.73" dst_port="8080"/>
            <filter src_ip="156.236.88.73" dst_port="80"/>
        </slice>
        <from usec="0" sec="1333516122"/>
        <to usec="0" sec="1333516130"/>
    </anomaly>
    <anomaly type="anomalous" value="0.949296,0.840538,502,1 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="8.49.205.173" src_port="22"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333516429"/>
    </anomaly>
    <anomaly type="anomalous" value="1.294670,1.044750,502,1 1 1 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="206.41.252.2" dst_ip="8.235.59.200"/>
            <filter src_ip="206.41.252.2" src_port="22"/>
            <filter dst_ip="8.235.59.200" src_port="22"/>
            <filter dst_ip="8.235.59.200" src_port="21246" dst_port="10798"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333516159"/>
    </anomaly>
    <anomaly type="anomalous" value="1.071410,0.878368,999,1 1 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="206.41.26.127" src_port="58534"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333516498"/>
    </anomaly>
    <anomaly type="anomalous" value="1.327660,1.129920,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="172.65.169.198" src_port="80"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333516429"/>
    </anomaly>
    <anomaly type="anomalous" value="1.272260,1.048560,503,1 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="207.237.144.190" src_port="80"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333516429"/>
    </anomaly>
    <anomaly type="anomalous" value="1.327660,1.129920,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="183.11.34.16" dst_ip="209.132.169.109" src_port="21"/>
            <filter src_ip="183.11.34.16" dst_ip="34.111.208.130" src_port="80"/>
        </slice>
        <from usec="0" sec="1333515603"/>
        <to usec="0" sec="1333516309"/>
    </anomaly>
    <anomaly type="anomalous" value="1.547140,1.218390,010,1 1 1 1 1 1 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="206.129.78.113" dst_port="23"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333516311"/>
    </anomaly>
    <anomaly type="anomalous" value="1.547140,1.218390,011,1 1 1 1 1 1 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="206.129.78.113" src_port="23"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333515979"/>
    </anomaly>
    <anomaly type="anomalous" value="1.365790,1.079120,503,1 1 0 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="206.41.250.1" src_port="80"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333516501"/>
    </anomaly>
    <anomaly type="anomalous" value="1.327660,1.129920,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="208.154.235.90" dst_ip="207.237.145.20" src_port="80"/>
        </slice>
        <from usec="0" sec="1333515765"/>
        <to usec="0" sec="1333516038"/>
    </anomaly>
    <anomaly type="anomalous" value="1.327660,1.129920,020,0 0 0 1 1 1 0 0 0 0 0 0,ttl_error">
        <slice>
            <filter src_ip="170.228.41.32" dst_ip="148.75.180.1"/>
            <filter src_ip="170.228.41.9" dst_ip="148.75.180.1"/>
            <filter src_ip="170.228.41.161" dst_ip="148.75.180.1"/>
            <filter src_ip="170.228.41.238" dst_ip="148.75.180.1"/>
            <filter src_ip="170.228.171.204" dst_ip="148.75.180.1"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333516339"/>
    </anomaly>
    <anomaly type="anomalous" value="1.462960,1.279190,999,0 0 0 1 1 1 1 0 0 0 0 0,mptp">
        <slice>
            <filter src_ip="49.101.71.249" dst_ip="206.41.253.199"/>
            <filter dst_ip="206.41.253.199" dst_port="51413"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333516429"/>
    </anomaly>
    <anomaly type="anomalous" value="1.327660,1.129920,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="36.89.164.157" dst_ip="136.209.96.208" src_port="80"/>
        </slice>
        <from usec="0" sec="1333515603"/>
        <to usec="0" sec="1333516429"/>
    </anomaly>
    <anomaly type="suspicious" value="0.557764,0.655690,503,1 0 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="207.226.2.2" dst_port="80"/>
        </slice>
        <from usec="0" sec="1333515627"/>
        <to usec="0" sec="1333516253"/>
    </anomaly>
    <anomaly type="suspicious" value="0.618945,0.683597,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="172.65.27.64" dst_ip="107.119.88.195" src_port="50586" dst_port="443"/>
        </slice>
        <from usec="0" sec="1333515886"/>
        <to usec="0" sec="1333515888"/>
    </anomaly>
    <anomaly type="suspicious" value="0.618945,0.683597,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="171.46.43.86" dst_ip="1.134.8.146" dst_port="80"/>
        </slice>
        <from usec="0" sec="1333516028"/>
        <to usec="0" sec="1333516030"/>
    </anomaly>
    <anomaly type="suspicious" value="0.618945,0.683597,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="223.68.76.175" src_port="6000" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1333516091"/>
        <to usec="0" sec="1333516094"/>
    </anomaly>
    <anomaly type="suspicious" value="0.618945,0.683597,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="172.65.30.67" dst_ip="213.114.120.222" src_port="49403" dst_port="80"/>
        </slice>
        <from usec="0" sec="1333516109"/>
        <to usec="0" sec="1333516150"/>
    </anomaly>
    <anomaly type="suspicious" value="0.618945,0.683597,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="12.83.120.27" dst_ip="206.41.247.60" dst_port="80"/>
        </slice>
        <from usec="0" sec="1333515855"/>
        <to usec="0" sec="1333516311"/>
    </anomaly>
    <anomaly type="suspicious" value="0.618945,0.683597,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="136.209.58.130" dst_port="80"/>
        </slice>
        <from usec="0" sec="1333515960"/>
        <to usec="0" sec="1333516150"/>
    </anomaly>
    <anomaly type="suspicious" value="0.618945,0.683597,504,1 1 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="170.228.28.26"/>
            <filter dst_ip="46.197.84.189" dst_port="443"/>
        </slice>
        <from usec="0" sec="1333515787"/>
        <to usec="0" sec="1333516015"/>
    </anomaly>
    <anomaly type="suspicious" value="0.618945,0.683597,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="172.65.169.198" dst_port="80"/>
        </slice>
        <from usec="0" sec="1333515932"/>
        <to usec="0" sec="1333516248"/>
    </anomaly>
    <anomaly type="suspicious" value="0.618945,0.683597,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="136.209.246.94" dst_ip="40.27.3.9" src_port="4598" dst_port="80"/>
            <filter src_ip="136.209.246.94" dst_ip="192.133.150.116" src_port="2367" dst_port="80"/>
            <filter src_ip="136.209.246.94" dst_ip="40.27.52.201" src_port="4675" dst_port="80"/>
        </slice>
        <from usec="0" sec="1333515868"/>
        <to usec="0" sec="1333515946"/>
    </anomaly>
    <anomaly type="suspicious" value="0.618945,0.683597,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="136.209.244.14" dst_ip="122.76.142.247" src_port="53262" dst_port="80"/>
            <filter src_ip="136.209.244.14" dst_ip="122.76.142.244" src_port="53207" dst_port="80"/>
            <filter src_ip="136.209.244.14" dst_ip="208.130.199.31" src_port="53755" dst_port="80"/>
            <filter src_ip="136.209.244.14" dst_ip="139.165.187.49" src_port="53756" dst_port="80"/>
        </slice>
        <from usec="0" sec="1333515863"/>
        <to usec="0" sec="1333516299"/>
    </anomaly>
    <anomaly type="suspicious" value="0.618945,0.683597,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="22.41.89.100" dst_port="445"/>
            <filter src_ip="22.41.89.100" dst_port="139"/>
        </slice>
        <from usec="0" sec="1333515766"/>
        <to usec="0" sec="1333515809"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674649,0.779207,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="171.46.40.210"/>
        </slice>
        <from usec="0" sec="1333515605"/>
        <to usec="0" sec="1333515797"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674649,0.779207,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="136.209.245.45"/>
        </slice>
        <from usec="0" sec="1333515605"/>
        <to usec="0" sec="1333515797"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674649,0.779207,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="209.132.169.148"/>
        </slice>
        <from usec="0" sec="1333515614"/>
        <to usec="0" sec="1333515780"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674649,0.779207,504,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="65.103.19.144"/>
        </slice>
        <from usec="0" sec="1333515634"/>
        <to usec="0" sec="1333515795"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674649,0.779207,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="13.16.100.137"/>
        </slice>
        <from usec="0" sec="1333515650"/>
        <to usec="0" sec="1333515736"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674649,0.779207,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="62.32.62.48"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333515978"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674649,0.779207,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.41.252.70" src_port="53"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333515979"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674649,0.779207,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="40.192.154.223"/>
        </slice>
        <from usec="0" sec="1333515602"/>
        <to usec="0" sec="1333516136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674649,0.779207,503,0 0 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="136.209.121.195"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333516068"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674649,0.779207,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="205.41.76.179"/>
        </slice>
        <from usec="0" sec="1333515648"/>
        <to usec="0" sec="1333516064"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674649,0.779207,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="84.45.162.76"/>
        </slice>
        <from usec="0" sec="1333515626"/>
        <to usec="0" sec="1333516159"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674649,0.779207,010,0 0 0 1 0 0 0 0 0 0 0 0,sptpDoSSYN">
        <slice>
            <filter dst_ip="132.99.190.116"/>
        </slice>
        <from usec="0" sec="1333515604"/>
        <to usec="0" sec="1333516242"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674649,0.779207,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="9.145.241.185"/>
        </slice>
        <from usec="0" sec="1333516044"/>
        <to usec="0" sec="1333516236"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674649,0.779207,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="172.65.112.84"/>
        </slice>
        <from usec="0" sec="1333515603"/>
        <to usec="0" sec="1333516325"/>
    </anomaly>
    <anomaly type="suspicious" value="0.674649,0.779207,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="139.165.208.182"/>
        </slice>
        <from usec="0" sec="1333515609"/>
        <to usec="0" sec="1333516334"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811150,0.969090,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="41.72.236.92"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333515647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811150,0.969090,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.41.246.112"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333515647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811150,0.969090,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="65.245.29.61" dst_port="53"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333515647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811150,0.969090,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="65.245.29.61" src_port="53"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333515647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811150,0.969090,010,0 0 0 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_port="80" dst_port="1234"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333515647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811150,0.969090,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="68.171.161.8"/>
        </slice>
        <from usec="0" sec="1333515736"/>
        <to usec="0" sec="1333515782"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811150,0.969090,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="68.171.161.8" src_port="53"/>
        </slice>
        <from usec="0" sec="1333515736"/>
        <to usec="0" sec="1333515782"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811150,0.969090,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.41.246.113" dst_port="53"/>
        </slice>
        <from usec="0" sec="1333515826"/>
        <to usec="0" sec="1333515872"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811150,0.969090,010,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.41.246.113" dst_port="80"/>
        </slice>
        <from usec="0" sec="1333515826"/>
        <to usec="0" sec="1333515872"/>
    </anomaly>
    <anomaly type="suspicious" value="0.716878,0.872869,010,1 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.41.253.2"/>
        </slice>
        <from usec="0" sec="1333515826"/>
        <to usec="0" sec="1333515962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811150,0.969090,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.41.251.134" dst_port="53"/>
        </slice>
        <from usec="0" sec="1333515826"/>
        <to usec="0" sec="1333515872"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811150,0.969090,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="65.226.211.101"/>
        </slice>
        <from usec="0" sec="1333516096"/>
        <to usec="0" sec="1333516142"/>
    </anomaly>
    <anomaly type="suspicious" value="0.716878,0.872869,020,1 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="206.41.246.113" src_port="18979"/>
            <filter src_ip="206.41.246.113"/>
        </slice>
        <from usec="0" sec="1333516047"/>
        <to usec="0" sec="1333516232"/>
    </anomaly>
    <anomaly type="suspicious" value="0.912541,0.983252,011,0 0 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="206.41.246.112"/>
            <filter src_ip="206.41.246.112"/>
            <filter src_ip="206.41.253.2"/>
            <filter src_ip="206.41.253.2"/>
        </slice>
        <from usec="0" sec="1333515603"/>
        <to usec="0" sec="1333516232"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811150,0.969090,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="14.48.227.14"/>
        </slice>
        <from usec="0" sec="1333516186"/>
        <to usec="0" sec="1333516232"/>
    </anomaly>
    <anomaly type="suspicious" value="0.912541,0.983252,011,0 0 0 1 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="207.237.74.216"/>
        </slice>
        <from usec="0" sec="1333515649"/>
        <to usec="0" sec="1333516232"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811150,0.969090,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.41.246.113"/>
        </slice>
        <from usec="0" sec="1333516186"/>
        <to usec="0" sec="1333516232"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811150,0.969090,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="14.48.227.14"/>
        </slice>
        <from usec="0" sec="1333516186"/>
        <to usec="0" sec="1333516232"/>
    </anomaly>
    <anomaly type="suspicious" value="0.829867,0.888567,010,1 0 0 1 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="207.237.74.216"/>
        </slice>
        <from usec="0" sec="1333515736"/>
        <to usec="0" sec="1333516286"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811150,0.969090,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="172.65.6.20" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1333515601"/>
        <to usec="0" sec="1333516457"/>
    </anomaly>
</admd:annotation>
