<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.602880,1.444390,503,1 1 1 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="152.157.193.110" src_port="80"/>
        </slice>
        <from usec="0" sec="1338959056"/>
        <to usec="0" sec="1338959354"/>
    </anomaly>
    <anomaly type="anomalous" value="1.709980,1.484540,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="148.8.114.244" src_port="5064" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338959565"/>
        <to usec="0" sec="1338959611"/>
    </anomaly>
    <anomaly type="anomalous" value="1.967000,1.607300,503,1 1 0 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="194.176.208.170" src_port="80"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959628"/>
    </anomaly>
    <anomaly type="anomalous" value="2.344920,1.808170,504,1 1 1 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="164.226.201.78" dst_port="80"/>
            <filter dst_ip="0.67.165.165" dst_port="443"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959386"/>
    </anomaly>
    <anomaly type="anomalous" value="1.914790,1.564620,010,1 1 1 0 0 0 1 1 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="93.252.224.11" dst_port="139"/>
        </slice>
        <from usec="0" sec="1338959011"/>
        <to usec="0" sec="1338959431"/>
    </anomaly>
    <anomaly type="anomalous" value="1.618940,1.473960,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="14.244.136.4" src_port="6000" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1338959673"/>
        <to usec="0" sec="1338959676"/>
    </anomaly>
    <anomaly type="anomalous" value="1.618940,1.473960,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="41.68.207.128" src_port="8888" dst_port="1433"/>
            <filter src_ip="41.68.207.128" src_port="8888" dst_port="8080"/>
            <filter src_ip="41.68.207.128" src_port="8888" dst_port="9090"/>
            <filter src_ip="41.68.207.128" src_port="8888" dst_port="8081"/>
        </slice>
        <from usec="0" sec="1338959299"/>
        <to usec="0" sec="1338959604"/>
    </anomaly>
    <anomaly type="anomalous" value="1.618940,1.473960,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="45.210.129.237" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1338959293"/>
        <to usec="0" sec="1338959295"/>
    </anomaly>
    <anomaly type="anomalous" value="1.709980,1.484540,010,1 1 1 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="42.232.21.232" src_port="80"/>
        </slice>
        <from usec="0" sec="1338959340"/>
        <to usec="0" sec="1338959386"/>
    </anomaly>
    <anomaly type="anomalous" value="1.618940,1.473960,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="43.200.223.122"/>
        </slice>
        <from usec="0" sec="1338958863"/>
        <to usec="0" sec="1338959585"/>
    </anomaly>
    <anomaly type="anomalous" value="1.694780,1.455190,010,1 1 1 1 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="90.184.214.239" dst_port="22"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959038"/>
    </anomaly>
    <anomaly type="anomalous" value="1.967000,1.607300,503,1 1 0 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="194.176.216.5" src_port="80"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959628"/>
    </anomaly>
    <anomaly type="anomalous" value="1.751930,1.573310,504,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="217.131.64.63" dst_ip="152.157.9.5" src_port="443"/>
            <filter src_ip="100.68.32.72" dst_ip="152.157.9.5" src_port="443"/>
        </slice>
        <from usec="0" sec="1338958995"/>
        <to usec="0" sec="1338959083"/>
    </anomaly>
    <anomaly type="anomalous" value="1.751930,1.573310,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="186.26.19.63" dst_ip="15.88.6.195" src_port="80" dst_port="61705"/>
            <filter src_ip="186.26.19.63" dst_ip="15.88.6.195" src_port="80" dst_port="52339"/>
            <filter src_ip="194.176.208.75" dst_ip="15.88.6.195" src_port="80" dst_port="35235"/>
        </slice>
        <from usec="0" sec="1338959462"/>
        <to usec="0" sec="1338959610"/>
    </anomaly>
    <anomaly type="anomalous" value="2.558140,1.882810,503,1 1 1 1 1 1 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="194.176.208.170" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959628"/>
    </anomaly>
    <anomaly type="anomalous" value="1.751930,1.573310,503,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="165.75.11.78" dst_ip="195.32.192.8" src_port="80"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959355"/>
    </anomaly>
    <anomaly type="anomalous" value="2.558140,1.882810,503,1 1 1 1 1 1 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="194.176.216.5" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959656"/>
    </anomaly>
    <anomaly type="anomalous" value="2.118710,1.619460,010,1 1 1 1 1 0 1 1 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="194.176.214.19"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959701"/>
    </anomaly>
    <anomaly type="anomalous" value="2.028470,1.658550,503,0 0 0 1 1 1 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="11.76.95.152" src_port="80"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959628"/>
    </anomaly>
    <anomaly type="anomalous" value="2.028470,1.658550,503,0 0 0 1 1 1 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="195.110.32.84" src_port="80"/>
            <filter dst_ip="195.98.230.224" src_port="80"/>
            <filter dst_ip="195.98.230.224" src_port="53"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959628"/>
    </anomaly>
    <anomaly type="anomalous" value="1.486470,1.337780,503,1 0 0 1 1 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="195.98.230.224" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959388"/>
    </anomaly>
    <anomaly type="anomalous" value="1.901230,1.536800,011,1 1 1 1 0 0 1 1 0 0 0 0,DDoSRSTrp">
        <slice>
            <filter src_ip="194.176.214.19"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.219220,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="45.12.119.247" dst_ip="195.110.35.73" src_port="80" dst_port="12334"/>
        </slice>
        <from usec="0" sec="1338958804"/>
        <to usec="0" sec="1338959614"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.219220,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="152.157.131.6" dst_ip="100.107.67.9" src_port="49799" dst_port="443"/>
        </slice>
        <from usec="0" sec="1338959016"/>
        <to usec="0" sec="1338959220"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.219220,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="194.176.210.188" dst_ip="54.236.243.16" src_port="34313" dst_port="65142"/>
        </slice>
        <from usec="0" sec="1338958870"/>
        <to usec="0" sec="1338959337"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.219220,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="46.182.166.68" dst_ip="194.176.222.200" src_port="54380" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338959233"/>
        <to usec="0" sec="1338959235"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.219220,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="162.68.39.247" dst_ip="205.197.67.43" dst_port="443"/>
        </slice>
        <from usec="0" sec="1338958837"/>
        <to usec="0" sec="1338959316"/>
    </anomaly>
    <anomaly type="suspicious" value="0.969381,1.183300,503,1 1 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="152.157.193.110" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338958841"/>
        <to usec="0" sec="1338959576"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.219220,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="152.157.131.75" dst_ip="61.253.113.111" src_port="50828" dst_port="443"/>
        </slice>
        <from usec="0" sec="1338959188"/>
        <to usec="0" sec="1338959190"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.219220,503,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="151.165.26.180" dst_ip="152.157.193.98" src_port="59407" dst_port="80"/>
            <filter src_ip="151.165.26.180" dst_ip="152.157.193.98" src_port="59405" dst_port="80"/>
            <filter src_ip="151.165.26.180" dst_ip="152.157.193.98" src_port="59404" dst_port="80"/>
            <filter src_ip="151.165.26.180" dst_ip="152.157.193.98" src_port="59403" dst_port="80"/>
            <filter src_ip="151.165.26.180" dst_ip="152.157.193.98" src_port="59399" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338959297"/>
        <to usec="0" sec="1338959299"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.219220,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="208.12.137.125" dst_ip="152.157.193.97" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338959270"/>
        <to usec="0" sec="1338959272"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.219220,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="0.89.114.24" dst_ip="152.157.128.29" src_port="80" dst_port="59618"/>
        </slice>
        <from usec="0" sec="1338959277"/>
        <to usec="0" sec="1338959281"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.219220,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="41.207.178.155" dst_ip="194.176.216.32" src_port="33296" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338959322"/>
        <to usec="0" sec="1338959324"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.219220,999,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="195.110.210.107" dst_ip="212.85.32.13" src_port="55623" dst_port="82"/>
        </slice>
        <from usec="0" sec="1338959235"/>
        <to usec="0" sec="1338959250"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.219220,011,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="93.252.224.11" src_port="139"/>
        </slice>
        <from usec="0" sec="1338959011"/>
        <to usec="0" sec="1338959041"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.219220,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="152.157.50.51" dst_ip="216.7.230.249" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338958863"/>
        <to usec="0" sec="1338958864"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.219220,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="48.18.174.123" src_port="8888" dst_port="1433"/>
            <filter src_ip="48.18.174.123" src_port="8888" dst_port="8081"/>
            <filter src_ip="48.18.174.123" src_port="8888" dst_port="8080"/>
            <filter src_ip="48.18.174.123" src_port="8888" dst_port="9090"/>
        </slice>
        <from usec="0" sec="1338959252"/>
        <to usec="0" sec="1338959405"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.219220,011,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="48.18.174.123" src_port="1433" dst_port="8888"/>
            <filter dst_ip="48.18.174.123" src_port="8081" dst_port="8888"/>
            <filter dst_ip="48.18.174.123" src_port="8080" dst_port="8888"/>
            <filter dst_ip="48.18.174.123" src_port="9090" dst_port="8888"/>
        </slice>
        <from usec="0" sec="1338959402"/>
        <to usec="0" sec="1338959405"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078970,1.230520,999,1 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="194.176.6.40" src_port="57872"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007030,1.246200,999,0 0 0 1 1 0 0 0 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="200.238.232.240"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.114790,1.196460,503,1 1 0 1 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="195.98.198.130" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959627"/>
    </anomaly>
    <anomaly type="suspicious" value="1.032400,1.280350,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959538"/>
    </anomaly>
    <anomaly type="suspicious" value="1.147680,1.258700,503,0 0 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="194.176.216.34" dst_port="80"/>
            <filter src_ip="213.160.26.123" dst_ip="194.176.216.32" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959358"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007030,1.246200,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="164.226.203.38" dst_ip="32.133.112.182" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338958801"/>
        <to usec="0" sec="1338959086"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007030,1.246200,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="152.157.1.133" dst_ip="195.99.97.146" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338958803"/>
        <to usec="0" sec="1338959028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007030,1.246200,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="164.226.80.221" dst_ip="216.23.160.32" dst_port="80"/>
            <filter src_ip="164.226.80.221" dst_ip="216.23.160.58" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338958827"/>
        <to usec="0" sec="1338959368"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007030,1.246200,503,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="162.68.36.138" dst_port="80"/>
            <filter dst_ip="148.81.174.105" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338958821"/>
        <to usec="0" sec="1338959248"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007030,1.246200,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="162.68.185.188" dst_ip="194.21.97.113" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338958862"/>
        <to usec="0" sec="1338959357"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007030,1.246200,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="195.99.23.166" dst_ip="152.157.123.206" src_port="2529" dst_port="51233"/>
            <filter src_ip="195.99.23.166" dst_ip="195.110.210.0" src_port="2530" dst_port="49214"/>
            <filter src_ip="195.99.23.166" dst_ip="152.157.123.29" src_port="2531" dst_port="49288"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959448"/>
    </anomaly>
    <anomaly type="suspicious" value="1.032400,1.280350,503,0 0 0 0 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="186.26.19.63"/>
        </slice>
        <from usec="0" sec="1338958878"/>
        <to usec="0" sec="1338959353"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007030,1.246200,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="45.12.119.234" dst_ip="194.176.218.203" src_port="80" dst_port="57279"/>
            <filter src_ip="45.12.119.234" dst_ip="194.176.218.203" src_port="80" dst_port="57150"/>
            <filter src_ip="45.12.119.234" dst_ip="195.98.219.25" src_port="80" dst_port="38741"/>
            <filter src_ip="45.12.119.234" dst_ip="195.110.33.37" src_port="80" dst_port="51481"/>
        </slice>
        <from usec="0" sec="1338959196"/>
        <to usec="0" sec="1338959446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.007030,1.246200,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="35.232.134.162" src_port="80"/>
        </slice>
        <from usec="0" sec="1338958802"/>
        <to usec="0" sec="1338959627"/>
    </anomaly>
    <anomaly type="suspicious" value="0.770042,1.133390,503,1 0 0 1 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="152.157.193.97" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338958837"/>
        <to usec="0" sec="1338959359"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.219220,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="195.110.34.61" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338958834"/>
        <to usec="0" sec="1338959345"/>
    </anomaly>
    <anomaly type="suspicious" value="1.088710,1.252030,999,0 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="194.176.217.123" dst_port="18979"/>
            <filter dst_ip="194.176.217.123"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959358"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177750,1.270830,999,1 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="42.203.129.112" dst_ip="162.153.234.229" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1338959287"/>
        <to usec="0" sec="1338959431"/>
    </anomaly>
    <anomaly type="suspicious" value="1.088710,1.252030,503,0 0 0 1 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="45.12.112.43" dst_ip="164.226.201.78" src_port="80"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959616"/>
    </anomaly>
    <anomaly type="suspicious" value="1.112220,1.286020,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="42.203.129.112" dst_ip="162.153.160.195" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338958846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.112220,1.286020,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="2.26.28.32" dst_ip="154.196.168.224" dst_port="53"/>
        </slice>
        <from usec="0" sec="1338959295"/>
        <to usec="0" sec="1338959341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.112220,1.286020,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="2.26.28.32" dst_ip="154.196.168.232" dst_port="53"/>
        </slice>
        <from usec="0" sec="1338959295"/>
        <to usec="0" sec="1338959341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.088710,1.252030,999,0 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="194.176.217.114" dst_port="18299"/>
        </slice>
        <from usec="0" sec="1338958822"/>
        <to usec="0" sec="1338959619"/>
    </anomaly>
    <anomaly type="suspicious" value="1.112220,1.286020,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="154.196.172.182" src_port="53"/>
        </slice>
        <from usec="0" sec="1338959160"/>
        <to usec="0" sec="1338959341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.112220,1.286020,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="20.153.25.20" dst_ip="162.153.187.161" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1338959295"/>
        <to usec="0" sec="1338959341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155570,1.236420,503,1 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="45.12.96.69" src_port="80"/>
            <filter dst_ip="152.157.1.205" src_port="80"/>
        </slice>
        <from usec="0" sec="1338958800"/>
        <to usec="0" sec="1338959538"/>
    </anomaly>
    <anomaly type="suspicious" value="1.112220,1.286020,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="129.198.185.120" dst_ip="162.153.51.136" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1338959295"/>
        <to usec="0" sec="1338959341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.112220,1.286020,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="195.221.21.26" dst_ip="194.176.215.18" src_port="80"/>
        </slice>
        <from usec="0" sec="1338959295"/>
        <to usec="0" sec="1338959341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.112220,1.286020,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="195.221.21.69" dst_ip="152.157.13.138" src_port="80"/>
        </slice>
        <from usec="0" sec="1338959295"/>
        <to usec="0" sec="1338959341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177750,1.270830,999,1 0 0 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="32.180.150.11" dst_ip="194.176.209.178"/>
            <filter src_ip="32.180.150.11" dst_port="53"/>
            <filter dst_ip="194.176.209.178" dst_port="53"/>
        </slice>
        <from usec="0" sec="1338959160"/>
        <to usec="0" sec="1338959386"/>
    </anomaly>
    <anomaly type="suspicious" value="1.112220,1.286020,503,0 0 0 0 0 0 1 1 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="195.110.195.84" dst_ip="12.106.130.233" dst_port="80"/>
            <filter src_ip="194.176.215.87" dst_ip="12.106.130.233" dst_port="80"/>
        </slice>
        <from usec="0" sec="1338959295"/>
        <to usec="0" sec="1338959341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.112220,1.286020,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="195.110.195.83" dst_port="24498"/>
        </slice>
        <from usec="0" sec="1338959160"/>
        <to usec="0" sec="1338959341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.112220,1.286020,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="16.60.158.104" dst_ip="162.153.194.242" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1338959295"/>
        <to usec="0" sec="1338959341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.112220,1.286020,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="32.180.150.11" src_port="53"/>
        </slice>
        <from usec="0" sec="1338959295"/>
        <to usec="0" sec="1338959341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.112220,1.286020,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="11.124.105.35" dst_ip="162.153.124.217" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1338959295"/>
        <to usec="0" sec="1338959341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.112220,1.286020,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="195.110.204.157" dst_port="53"/>
        </slice>
        <from usec="0" sec="1338959160"/>
        <to usec="0" sec="1338959341"/>
    </anomaly>
    <anomaly type="suspicious" value="1.112220,1.286020,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="11.76.95.152" dst_ip="164.226.37.145" src_port="80"/>
        </slice>
        <from usec="0" sec="1338959340"/>
        <to usec="0" sec="1338959386"/>
    </anomaly>
</admd:annotation>
