<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.009770,0.962419,503,1 1 1 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="129.79.155.117" dst_port="80"/>
            <filter dst_ip="205.109.124.89" dst_port="80"/>
            <filter dst_ip="205.109.124.89" dst_port="12350"/>
            <filter dst_ip="205.109.124.89" dst_port="443"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194510"/>
    </anomaly>
    <anomaly type="anomalous" value="0.959691,0.935073,503,1 1 1 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="129.79.55.13" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194046"/>
        <to usec="0" sec="1336194900"/>
    </anomaly>
    <anomaly type="anomalous" value="0.959691,0.935073,010,1 1 1 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="19.165.184.133" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194810"/>
        <to usec="0" sec="1336194856"/>
    </anomaly>
    <anomaly type="anomalous" value="1.510760,1.203030,503,1 1 1 1 1 1 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="198.88.148.32" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194901"/>
    </anomaly>
    <anomaly type="anomalous" value="0.959691,0.935073,999,1 1 1 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="199.128.110.3" src_port="53"/>
        </slice>
        <from usec="0" sec="1336194360"/>
        <to usec="0" sec="1336194773"/>
    </anomaly>
    <anomaly type="anomalous" value="2.225460,1.749670,010,1 1 1 1 1 1 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="19.165.186.35" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194360"/>
        <to usec="0" sec="1336194406"/>
    </anomaly>
    <anomaly type="anomalous" value="0.959691,0.935073,503,1 1 1 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="129.79.37.192" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194596"/>
        <to usec="0" sec="1336194901"/>
    </anomaly>
    <anomaly type="anomalous" value="0.959691,0.935073,011,1 1 1 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="36.54.204.2" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194055"/>
        <to usec="0" sec="1336194797"/>
    </anomaly>
    <anomaly type="anomalous" value="0.959691,0.935073,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="22.244.76.10" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1336194270"/>
        <to usec="0" sec="1336194316"/>
    </anomaly>
    <anomaly type="anomalous" value="1.510760,1.203030,503,1 1 1 1 1 1 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="199.96.214.246" dst_port="80"/>
            <filter src_ip="199.96.214.246" dst_port="53"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194900"/>
    </anomaly>
    <anomaly type="anomalous" value="1.028180,0.941059,999,1 1 1 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="31.9.12.241" dst_port="53"/>
            <filter dst_ip="129.79.106.106" dst_port="53"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194746"/>
    </anomaly>
    <anomaly type="anomalous" value="1.277860,1.135910,503,1 0 0 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="177.136.10.135" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194821"/>
    </anomaly>
    <anomaly type="anomalous" value="1.510760,1.203030,503,1 1 1 1 1 1 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="198.88.148.32" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194900"/>
    </anomaly>
    <anomaly type="anomalous" value="1.327620,1.155100,999,0 0 0 1 1 0 1 1 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="204.201.158.194"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194856"/>
    </anomaly>
    <anomaly type="anomalous" value="1.254060,1.146440,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="162.96.52.160" dst_ip="34.8.123.203" src_port="80" dst_port="43492"/>
        </slice>
        <from usec="0" sec="1336194581"/>
        <to usec="0" sec="1336194596"/>
    </anomaly>
    <anomaly type="anomalous" value="2.225460,1.749670,999,1 1 1 1 1 1 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="198.88.16.173" src_port="50001"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194900"/>
    </anomaly>
    <anomaly type="anomalous" value="1.254060,1.146440,999,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="198.88.145.233"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194824"/>
    </anomaly>
    <anomaly type="anomalous" value="1.254060,1.146440,502,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="198.88.153.35" dst_ip="204.149.144.142" src_port="53"/>
            <filter src_ip="198.88.154.33" dst_ip="204.149.144.142" dst_port="22"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194108"/>
    </anomaly>
    <anomaly type="anomalous" value="1.254060,1.146440,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="162.96.2.182" dst_ip="43.37.194.185" src_port="80"/>
            <filter src_ip="162.96.2.182" dst_ip="211.228.31.232" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194053"/>
        <to usec="0" sec="1336194272"/>
    </anomaly>
    <anomaly type="anomalous" value="1.254060,1.146440,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="181.112.174.187" dst_ip="43.37.197.220" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194058"/>
        <to usec="0" sec="1336194732"/>
    </anomaly>
    <anomaly type="anomalous" value="1.254060,1.146440,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="162.96.52.168" dst_ip="43.37.194.212" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194071"/>
        <to usec="0" sec="1336194826"/>
    </anomaly>
    <anomaly type="anomalous" value="1.254060,1.146440,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="177.144.206.69" dst_ip="34.8.123.26" src_port="80" dst_port="50194"/>
        </slice>
        <from usec="0" sec="1336194107"/>
        <to usec="0" sec="1336194112"/>
    </anomaly>
    <anomaly type="anomalous" value="1.254060,1.146440,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="162.96.101.82" dst_ip="211.228.31.37" src_port="80" dst_port="47842"/>
        </slice>
        <from usec="0" sec="1336194603"/>
        <to usec="0" sec="1336194608"/>
    </anomaly>
    <anomaly type="anomalous" value="1.254060,1.146440,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="181.112.174.1" dst_ip="211.228.31.65" src_port="80" dst_port="53325"/>
        </slice>
        <from usec="0" sec="1336194578"/>
        <to usec="0" sec="1336194582"/>
    </anomaly>
    <anomaly type="anomalous" value="1.250720,1.033060,503,1 1 1 1 1 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="198.88.152.189" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194875"/>
    </anomaly>
    <anomaly type="anomalous" value="1.254060,1.146440,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="181.112.16.27" dst_ip="211.228.31.138" src_port="80" dst_port="36861"/>
            <filter src_ip="177.144.53.129" dst_ip="211.228.31.138" src_port="80" dst_port="57832"/>
            <filter src_ip="162.96.14.70" dst_ip="211.228.31.138" src_port="80" dst_port="44171"/>
        </slice>
        <from usec="0" sec="1336194613"/>
        <to usec="0" sec="1336194670"/>
    </anomaly>
    <anomaly type="anomalous" value="1.254060,1.146440,999,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="162.96.105.27" dst_ip="211.228.31.159" src_port="46552" dst_port="44004"/>
            <filter src_ip="162.96.105.27" dst_ip="211.228.31.159" src_port="21" dst_port="58661"/>
            <filter src_ip="162.96.9.23" dst_ip="211.228.31.159" src_port="80" dst_port="61893"/>
            <filter src_ip="177.30.140.245" dst_ip="211.228.31.159" src_port="80" dst_port="64483"/>
        </slice>
        <from usec="0" sec="1336194383"/>
        <to usec="0" sec="1336194532"/>
    </anomaly>
    <anomaly type="anomalous" value="1.268930,1.128570,999,0 0 0 1 1 1 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="17.20.114.162" dst_ip="198.88.148.40"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194828"/>
    </anomaly>
    <anomaly type="anomalous" value="1.388400,1.151630,010,1 1 1 1 0 0 1 1 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="198.88.157.118"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194901"/>
    </anomaly>
    <anomaly type="anomalous" value="1.560380,1.227960,011,1 1 1 1 1 0 1 1 0 0 0 0,DDoSRSTrp">
        <slice>
            <filter src_ip="198.88.157.118"/>
            <filter src_ip="198.88.157.107"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194901"/>
    </anomaly>
    <anomaly type="anomalous" value="1.338470,1.146740,010,1 1 1 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="156.166.35.217" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194025"/>
        <to usec="0" sec="1336194898"/>
    </anomaly>
    <anomaly type="anomalous" value="1.887420,1.583560,011,0 0 0 1 1 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="198.88.149.29"/>
        </slice>
        <from usec="0" sec="1336194001"/>
        <to usec="0" sec="1336194901"/>
    </anomaly>
    <anomaly type="anomalous" value="0.959691,0.935073,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="60.219.34.196" dst_port="23"/>
        </slice>
        <from usec="0" sec="1336194504"/>
        <to usec="0" sec="1336194901"/>
    </anomaly>
    <anomaly type="anomalous" value="1.895070,1.577470,999,1 1 1 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="17.120.189.233" dst_port="53"/>
        </slice>
        <from usec="0" sec="1336194810"/>
        <to usec="0" sec="1336194901"/>
    </anomaly>
    <anomaly type="anomalous" value="1.726080,1.513530,011,1 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="199.106.29.140"/>
        </slice>
        <from usec="0" sec="1336194343"/>
        <to usec="0" sec="1336194811"/>
    </anomaly>
    <anomaly type="anomalous" value="1.708530,1.521440,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="199.106.16.173" src_port="24498"/>
        </slice>
        <from usec="0" sec="1336194360"/>
        <to usec="0" sec="1336194451"/>
    </anomaly>
    <anomaly type="suspicious" value="0.717482,0.883890,504,1 1 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="220.67.100.107" dst_ip="129.79.37.205" dst_port="443"/>
            <filter src_ip="216.120.82.136" dst_ip="129.79.37.205" dst_port="443"/>
            <filter src_ip="87.229.214.10" dst_ip="129.79.37.205" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194071"/>
        <to usec="0" sec="1336194082"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939938,0.956566,504,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.145.28.237" src_port="443"/>
            <filter src_ip="203.145.28.237" dst_ip="129.79.176.55" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194216"/>
        <to usec="0" sec="1336194221"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939938,0.956566,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="129.79.37.204" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194199"/>
        <to usec="0" sec="1336194682"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939938,0.956566,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="47.208.21.133" dst_ip="129.79.55.13" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194505"/>
        <to usec="0" sec="1336194881"/>
    </anomaly>
    <anomaly type="suspicious" value="0.717482,0.883890,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="129.79.132.168" dst_ip="155.159.33.205" src_port="49495" dst_port="190"/>
        </slice>
        <from usec="0" sec="1336194537"/>
        <to usec="0" sec="1336194873"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939938,0.956566,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="162.96.105.64" dst_ip="211.228.31.50" src_port="80" dst_port="55564"/>
            <filter src_ip="162.96.105.64" dst_ip="211.228.31.50" src_port="80" dst_port="52579"/>
            <filter src_ip="162.96.105.64" dst_ip="211.228.31.50" src_port="80" dst_port="52139"/>
            <filter src_ip="162.96.105.64" dst_ip="211.228.31.50" src_port="80" dst_port="50908"/>
            <filter src_ip="162.96.105.64" dst_ip="211.228.31.50" src_port="80" dst_port="43013"/>
        </slice>
        <from usec="0" sec="1336194543"/>
        <to usec="0" sec="1336194841"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939938,0.956566,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="177.144.214.131" dst_ip="34.8.123.209" src_port="80" dst_port="57677"/>
            <filter src_ip="177.144.214.131" dst_ip="43.37.192.32" src_port="80" dst_port="56195"/>
            <filter src_ip="177.144.214.131" dst_ip="34.8.123.188" src_port="80" dst_port="60707"/>
        </slice>
        <from usec="0" sec="1336194393"/>
        <to usec="0" sec="1336194797"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939938,0.956566,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="69.118.101.50" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194470"/>
        <to usec="0" sec="1336194507"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939938,0.956566,504,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="129.79.84.90" dst_ip="109.6.55.231" src_port="58262" dst_port="443"/>
            <filter src_ip="129.79.84.90" dst_ip="139.58.67.213" src_port="58255" dst_port="443"/>
            <filter src_ip="129.79.84.90" dst_ip="72.225.165.4" src_port="58264" dst_port="443"/>
            <filter src_ip="129.79.84.90" dst_ip="33.56.116.129" src_port="58118" dst_port="443"/>
            <filter src_ip="129.79.84.90" dst_ip="41.5.64.246" src_port="58263" dst_port="443"/>
        </slice>
        <from usec="0" sec="1336194056"/>
        <to usec="0" sec="1336194777"/>
    </anomaly>
    <anomaly type="suspicious" value="0.717482,0.883890,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="129.79.90.173" dst_ip="61.203.25.201" src_port="50976" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194521"/>
        <to usec="0" sec="1336194793"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939938,0.956566,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="177.136.50.13" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194516"/>
        <to usec="0" sec="1336194523"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939938,0.956566,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="144.55.168.204" dst_ip="177.136.175.36" dst_port="80"/>
            <filter src_ip="144.55.168.204" dst_ip="177.136.175.12" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194549"/>
        <to usec="0" sec="1336194605"/>
    </anomaly>
    <anomaly type="suspicious" value="0.717482,0.883890,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="129.79.227.217" dst_ip="56.98.74.77" dst_port="182"/>
        </slice>
        <from usec="0" sec="1336194521"/>
        <to usec="0" sec="1336194831"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939938,0.956566,503,1 1 1 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="129.79.37.204" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194583"/>
        <to usec="0" sec="1336194855"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743172,0.860583,503,1 1 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="129.79.37.195" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194583"/>
        <to usec="0" sec="1336194901"/>
    </anomaly>
    <anomaly type="suspicious" value="0.717482,0.883890,504,1 1 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="24.110.74.171" dst_ip="180.175.167.128" src_port="443" dst_port="52253"/>
            <filter src_ip="24.110.74.171" dst_ip="180.175.167.128" src_port="443" dst_port="52252"/>
            <filter src_ip="24.110.74.186" dst_ip="180.175.167.128" src_port="443" dst_port="52249"/>
        </slice>
        <from usec="0" sec="1336194226"/>
        <to usec="0" sec="1336194231"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939938,0.956566,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="177.144.229.74" dst_ip="43.37.197.104" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194474"/>
        <to usec="0" sec="1336194477"/>
    </anomaly>
    <anomaly type="suspicious" value="0.717482,0.883890,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="177.136.10.135" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194509"/>
        <to usec="0" sec="1336194831"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939938,0.956566,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="60.219.34.196" src_port="23"/>
        </slice>
        <from usec="0" sec="1336194532"/>
        <to usec="0" sec="1336194538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.717482,0.883890,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="199.106.191.139" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194503"/>
        <to usec="0" sec="1336194831"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939938,0.956566,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="53.179.173.38" dst_port="445"/>
            <filter src_ip="53.179.173.38" dst_port="139"/>
        </slice>
        <from usec="0" sec="1336194030"/>
        <to usec="0" sec="1336194085"/>
    </anomaly>
    <anomaly type="suspicious" value="0.717482,0.883890,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="38.207.14.25" dst_port="135"/>
        </slice>
        <from usec="0" sec="1336194434"/>
        <to usec="0" sec="1336194446"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939938,0.956566,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="8.135.104.46" dst_port="445"/>
        </slice>
        <from usec="0" sec="1336194176"/>
        <to usec="0" sec="1336194250"/>
    </anomaly>
    <anomaly type="suspicious" value="0.717482,0.883890,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.26.216.187" dst_port="1433"/>
            <filter src_ip="222.26.216.187" dst_port="445"/>
        </slice>
        <from usec="0" sec="1336194729"/>
        <to usec="0" sec="1336194732"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939938,0.956566,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="17.172.16.4" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1336194525"/>
        <to usec="0" sec="1336194533"/>
    </anomaly>
    <anomaly type="suspicious" value="0.717482,0.883890,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.145.31.207" dst_port="80"/>
            <filter src_ip="129.79.166.165" dst_ip="203.145.31.207" dst_port="443"/>
        </slice>
        <from usec="0" sec="1336194667"/>
        <to usec="0" sec="1336194669"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939938,0.956566,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="8.135.104.46" src_port="445"/>
        </slice>
        <from usec="0" sec="1336194176"/>
        <to usec="0" sec="1336194249"/>
    </anomaly>
    <anomaly type="suspicious" value="0.638510,0.853586,503,1 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="177.136.173.127" dst_ip="198.174.97.20" src_port="50409" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194831"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,999,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter dst_ip="222.149.95.24"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194108"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="211.228.31.32"/>
        </slice>
        <from usec="0" sec="1336194629"/>
        <to usec="0" sec="1336194641"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="18.67.46.194"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194288"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="211.228.31.136"/>
        </slice>
        <from usec="0" sec="1336194321"/>
        <to usec="0" sec="1336194333"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,504,0 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="129.79.154.156"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194468"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,504,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="14.2.33.102"/>
        </slice>
        <from usec="0" sec="1336194242"/>
        <to usec="0" sec="1336194353"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,503,0 0 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="129.79.155.195"/>
        </slice>
        <from usec="0" sec="1336194007"/>
        <to usec="0" sec="1336194550"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,999,0 0 0 1 0 0 0 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter dst_ip="47.101.179.137"/>
        </slice>
        <from usec="0" sec="1336194246"/>
        <to usec="0" sec="1336194558"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="64.147.119.191"/>
        </slice>
        <from usec="0" sec="1336194417"/>
        <to usec="0" sec="1336194457"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="34.8.123.49"/>
        </slice>
        <from usec="0" sec="1336194464"/>
        <to usec="0" sec="1336194476"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,020,0 0 0 1 0 0 0 0 0 0 0 0,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="34.32.154.133" dst_port="80"/>
            <filter dst_ip="34.32.154.133"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194738"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="199.106.10.90"/>
        </slice>
        <from usec="0" sec="1336194002"/>
        <to usec="0" sec="1336194727"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="129.79.218.11"/>
        </slice>
        <from usec="0" sec="1336194006"/>
        <to usec="0" sec="1336194733"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,999,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="8.183.157.38"/>
        </slice>
        <from usec="0" sec="1336194021"/>
        <to usec="0" sec="1336194715"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,504,0 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="5.149.222.17"/>
        </slice>
        <from usec="0" sec="1336194107"/>
        <to usec="0" sec="1336194729"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,503,0 0 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="199.106.188.172"/>
        </slice>
        <from usec="0" sec="1336194230"/>
        <to usec="0" sec="1336194718"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="211.228.31.14"/>
        </slice>
        <from usec="0" sec="1336194539"/>
        <to usec="0" sec="1336194645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="180.175.239.170"/>
        </slice>
        <from usec="0" sec="1336194590"/>
        <to usec="0" sec="1336194727"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,999,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="198.88.145.196"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194824"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,999,0 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="177.41.50.131" dst_port="25"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194824"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,999,0 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="204.166.236.174"/>
        </slice>
        <from usec="0" sec="1336194003"/>
        <to usec="0" sec="1336194828"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,020,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="65.224.42.195"/>
        </slice>
        <from usec="0" sec="1336194005"/>
        <to usec="0" sec="1336194795"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="208.104.7.225"/>
        </slice>
        <from usec="0" sec="1336194043"/>
        <to usec="0" sec="1336194816"/>
    </anomaly>
    <anomaly type="suspicious" value="0.638510,0.853586,503,1 0 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="198.88.148.9" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194537"/>
        <to usec="0" sec="1336194887"/>
    </anomaly>
    <anomaly type="suspicious" value="0.589425,0.867542,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="39.110.166.191"/>
        </slice>
        <from usec="0" sec="1336194800"/>
        <to usec="0" sec="1336194807"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924425,0.966571,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="177.144.53.129" dst_ip="211.228.31.158" src_port="80"/>
        </slice>
        <from usec="0" sec="1336194101"/>
        <to usec="0" sec="1336194196"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924425,0.966571,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="177.136.50.179" src_port="3480"/>
            <filter src_ip="202.3.186.0" dst_ip="177.136.50.179" src_port="3478"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194738"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924425,0.966571,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="129.79.154.238" dst_ip="147.160.184.167" src_port="6699" dst_port="7390"/>
        </slice>
        <from usec="0" sec="1336194001"/>
        <to usec="0" sec="1336194738"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620440,0.843783,999,0 0 0 1 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="198.88.148.40" dst_ip="17.20.114.162"/>
        </slice>
        <from usec="0" sec="1336194332"/>
        <to usec="0" sec="1336194735"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620440,0.843783,999,0 0 0 1 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="198.88.149.16" src_port="18299"/>
        </slice>
        <from usec="0" sec="1336194006"/>
        <to usec="0" sec="1336194736"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620440,0.843783,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="129.79.2.85" src_port="53"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194828"/>
    </anomaly>
    <anomaly type="suspicious" value="0.555939,0.822629,010,1 0 0 0 0 0 1 0 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="198.88.157.107"/>
        </slice>
        <from usec="0" sec="1336194341"/>
        <to usec="0" sec="1336194901"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743172,0.860583,503,1 1 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="198.88.152.189" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194580"/>
        <to usec="0" sec="1336194901"/>
    </anomaly>
    <anomaly type="suspicious" value="0.555939,0.822629,503,1 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="180.175.186.208" dst_ip="174.154.200.98" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194810"/>
        <to usec="0" sec="1336194856"/>
    </anomaly>
    <anomaly type="suspicious" value="0.620440,0.843783,503,0 0 0 1 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="198.88.148.9" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.057970,1.068360,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="198.88.149.28" dst_port="18979"/>
            <filter dst_ip="198.88.149.28" dst_port="53"/>
            <filter dst_ip="198.88.149.28"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.057970,1.068360,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="198.88.149.29" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.057970,1.068360,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="198.88.157.107" dst_port="80"/>
        </slice>
        <from usec="0" sec="1336194000"/>
        <to usec="0" sec="1336194046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.057970,1.068360,999,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="198.88.149.28" src_port="18979"/>
            <filter src_ip="198.88.149.28" src_port="53"/>
            <filter src_ip="198.88.149.28"/>
        </slice>
        <from usec="0" sec="1336194360"/>
        <to usec="0" sec="1336194901"/>
    </anomaly>
</admd:annotation>
