<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.100080,1.202210,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="200.57.162.252" dst_ip="41.36.117.114" src_port="33943" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1341638087"/>
        <to usec="0" sec="1341638090"/>
    </anomaly>
    <anomaly type="suspicious" value="1.100080,1.202210,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="161.11.179.46" dst_ip="77.230.132.0" src_port="51946" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1341638087"/>
        <to usec="0" sec="1341638090"/>
    </anomaly>
    <anomaly type="suspicious" value="1.100080,1.202210,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="185.3.8.29" dst_ip="97.107.181.66" src_port="64652" dst_port="1619" proto="udp"/>
        </slice>
        <from usec="0" sec="1341637930"/>
        <to usec="0" sec="1341638074"/>
    </anomaly>
    <anomaly type="suspicious" value="1.100080,1.202210,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="2.56.218.108"/>
        </slice>
        <from usec="0" sec="1341638087"/>
        <to usec="0" sec="1341638090"/>
    </anomaly>
    <anomaly type="suspicious" value="1.100080,1.202210,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="164.250.96.198"/>
        </slice>
        <from usec="0" sec="1341638087"/>
        <to usec="0" sec="1341638090"/>
    </anomaly>
    <anomaly type="suspicious" value="1.100080,1.202210,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="151.239.174.222"/>
        </slice>
        <from usec="0" sec="1341638087"/>
        <to usec="0" sec="1341638090"/>
    </anomaly>
    <anomaly type="suspicious" value="1.100080,1.202210,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="151.239.37.120" dst_ip="213.118.179.2" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1341638087"/>
        <to usec="0" sec="1341638090"/>
    </anomaly>
    <anomaly type="suspicious" value="1.100080,1.202210,503,1 0 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="128.7.217.145" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1341638087"/>
        <to usec="0" sec="1341638090"/>
    </anomaly>
    <anomaly type="suspicious" value="1.100080,1.202210,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.20.116.151"/>
        </slice>
        <from usec="0" sec="1341638087"/>
        <to usec="0" sec="1341638090"/>
    </anomaly>
    <anomaly type="suspicious" value="1.100080,1.202210,999,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="25.67.85.59" src_port="1826" proto="udp"/>
        </slice>
        <from usec="0" sec="1341638087"/>
        <to usec="0" sec="1341638090"/>
    </anomaly>
    <anomaly type="suspicious" value="1.100080,1.202210,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="14.237.69.6" proto="icmp"/>
        </slice>
        <from usec="0" sec="1341637400"/>
        <to usec="0" sec="1341637405"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914831,0.983561,999,0 0 0 1 1 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="151.239.33.66" dst_port="58314"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637938"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="46.54.78.150" dst_ip="161.17.218.30" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637398"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="164.250.149.47" dst_ip="42.225.101.251" src_port="7320" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637398"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="151.239.36.0" dst_ip="205.31.105.212" src_port="57723" dst_port="1935"/>
            <filter src_ip="151.239.36.0" dst_ip="205.31.105.212" src_port="57697" dst_port="1935"/>
        </slice>
        <from usec="0" sec="1341637320"/>
        <to usec="0" sec="1341637366"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="63.4.166.188" dst_ip="201.20.115.78" src_port="55232" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637371"/>
        <to usec="0" sec="1341637398"/>
    </anomaly>
    <anomaly type="suspicious" value="0.766943,1.096260,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637938"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="151.239.222.23" dst_ip="138.125.61.161" src_port="80" dst_port="10509"/>
        </slice>
        <from usec="0" sec="1341637458"/>
        <to usec="0" sec="1341637463"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="151.239.36.11" src_port="443"/>
            <filter src_ip="196.253.12.9" dst_ip="151.239.36.11" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="200.57.82.50" dst_ip="192.2.92.128" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637206"/>
        <to usec="0" sec="1341637572"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="221.82.212.38" dst_port="443"/>
            <filter src_ip="221.82.212.38" dst_ip="200.52.65.137" dst_port="80"/>
            <filter src_ip="6.6.187.66" dst_ip="200.52.65.137" dst_port="443"/>
        </slice>
        <from usec="0" sec="1341637273"/>
        <to usec="0" sec="1341637515"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="200.52.65.118" dst_ip="12.11.168.118" src_port="7891" dst_port="14907"/>
            <filter src_ip="200.52.65.118" dst_ip="12.11.168.118" src_port="6767" dst_port="14689"/>
        </slice>
        <from usec="0" sec="1341637468"/>
        <to usec="0" sec="1341637578"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,504,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="201.20.122.80" dst_ip="72.236.227.206" dst_port="443"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637534"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,020,0 0 0 1 1 0 0 0 0 0 0 0,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="98.102.247.95" dst_port="21"/>
            <filter dst_ip="98.102.247.95"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637848"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.57.89.52" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.11.251.145" dst_port="21158"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637817"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.11.134.77" src_port="53"/>
            <filter dst_ip="161.11.134.77" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,020,0 0 0 1 1 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="44.170.32.128"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637848"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="201.20.124.179" dst_ip="97.152.232.41" src_port="51413" dst_port="16001"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637843"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="151.239.69.7" dst_ip="33.228.149.224" src_port="51285" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637201"/>
        <to usec="0" sec="1341637848"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,999,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="193.69.104.209" dst_port="12350"/>
            <filter dst_ip="193.69.104.209" dst_port="443"/>
        </slice>
        <from usec="0" sec="1341637202"/>
        <to usec="0" sec="1341637795"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,020,0 0 0 1 1 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="138.114.64.246" dst_ip="201.20.109.27" src_port="41244" dst_port="80"/>
            <filter src_ip="3.68.210.196" dst_ip="201.20.109.27"/>
        </slice>
        <from usec="0" sec="1341637205"/>
        <to usec="0" sec="1341637843"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,504,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="206.34.158.147" dst_port="443"/>
        </slice>
        <from usec="0" sec="1341637201"/>
        <to usec="0" sec="1341637848"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="164.250.208.10" src_port="53"/>
            <filter src_ip="46.54.79.24" dst_ip="164.250.208.10" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637210"/>
        <to usec="0" sec="1341637812"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="151.239.222.25" dst_ip="14.198.135.78" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637702"/>
        <to usec="0" sec="1341637716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="151.239.36.214" dst_ip="196.134.211.166" src_port="51980" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637739"/>
        <to usec="0" sec="1341637848"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="201.20.121.99" dst_ip="9.216.26.29" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637800"/>
        <to usec="0" sec="1341637841"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="151.239.36.11" dst_ip="52.41.103.138" src_port="54326" dst_port="9016"/>
            <filter src_ip="151.239.36.11" dst_ip="52.41.103.138" src_port="54299" dst_port="9016"/>
            <filter src_ip="151.239.36.11" dst_ip="52.41.103.138" src_port="54298" dst_port="9016"/>
            <filter src_ip="151.239.36.11" dst_ip="52.41.103.138" src_port="54297" dst_port="9016"/>
            <filter src_ip="151.239.36.11" dst_ip="52.41.103.138" src_port="54296" dst_port="9016"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,502,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="201.20.120.247" dst_ip="192.27.86.131" src_port="53"/>
            <filter src_ip="201.20.123.89" dst_ip="192.27.86.131" dst_port="22"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="200.52.65.118" dst_ip="100.48.83.213" src_port="6767" dst_port="12444"/>
        </slice>
        <from usec="0" sec="1341637201"/>
        <to usec="0" sec="1341638027"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="151.239.164.34" src_port="80"/>
            <filter dst_ip="151.239.164.34" src_port="443"/>
        </slice>
        <from usec="0" sec="1341637202"/>
        <to usec="0" sec="1341638025"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="201.20.10.144" dst_port="15103"/>
        </slice>
        <from usec="0" sec="1341637202"/>
        <to usec="0" sec="1341638027"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914831,0.983561,503,0 0 0 1 1 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="201.20.121.99" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="13.162.0.23" dst_ip="151.239.89.59" src_port="80"/>
            <filter src_ip="13.162.7.0" dst_ip="151.239.89.59" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637204"/>
        <to usec="0" sec="1341638015"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="200.52.65.118" dst_ip="13.175.171.199" src_port="6767" dst_port="13099"/>
        </slice>
        <from usec="0" sec="1341637204"/>
        <to usec="0" sec="1341638025"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="151.239.38.77" dst_ip="134.71.147.118" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637207"/>
        <to usec="0" sec="1341638022"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="19.17.196.163" dst_port="40002"/>
        </slice>
        <from usec="0" sec="1341637210"/>
        <to usec="0" sec="1341638026"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="164.250.130.87" dst_ip="223.56.48.130" src_port="3519" dst_port="443"/>
            <filter src_ip="164.250.133.141" dst_ip="223.56.48.130" src_port="48029" dst_port="443"/>
            <filter src_ip="164.250.46.219" dst_ip="223.56.48.130" src_port="50103" dst_port="443"/>
            <filter src_ip="164.250.92.228" dst_ip="223.56.48.130" src_port="63280" dst_port="443"/>
        </slice>
        <from usec="0" sec="1341637213"/>
        <to usec="0" sec="1341638027"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="165.110.58.30" dst_ip="42.241.244.45" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637219"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,901,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="151.239.222.23" dst_ip="19.33.205.236" src_port="80" dst_port="1811"/>
        </slice>
        <from usec="0" sec="1341637852"/>
        <to usec="0" sec="1341637853"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="200.52.97.76" dst_ip="56.177.47.20" src_port="53"/>
            <filter src_ip="200.52.97.78" dst_ip="56.177.47.20" src_port="53"/>
        </slice>
        <from usec="0" sec="1341637865"/>
        <to usec="0" sec="1341637921"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="161.11.226.148"/>
        </slice>
        <from usec="0" sec="1341637868"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="200.52.97.78" dst_ip="24.31.33.11" src_port="53"/>
            <filter src_ip="200.52.97.76" dst_ip="24.31.33.11" src_port="53"/>
            <filter src_ip="200.52.97.103" dst_ip="24.31.33.11" src_port="53"/>
        </slice>
        <from usec="0" sec="1341637884"/>
        <to usec="0" sec="1341637983"/>
    </anomaly>
    <anomaly type="suspicious" value="0.706083,1.058770,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="164.250.65.15" dst_ip="213.67.44.246" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637884"/>
        <to usec="0" sec="1341638024"/>
    </anomaly>
    <anomaly type="suspicious" value="1.363000,1.392410,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637488"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914831,0.983561,999,0 0 0 1 1 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="200.171.109.130" src_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637933"/>
    </anomaly>
    <anomaly type="suspicious" value="0.732480,0.935513,503,0 0 0 1 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.20.115.76" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637398"/>
    </anomaly>
    <anomaly type="suspicious" value="0.732480,0.935513,503,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="200.57.67.182"/>
            <filter src_ip="200.57.67.182" src_port="62306"/>
            <filter src_ip="200.57.67.182"/>
            <filter src_ip="201.20.114.19"/>
            <filter src_ip="201.20.114.19"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637848"/>
    </anomaly>
    <anomaly type="suspicious" value="0.732480,0.935513,020,0 0 0 1 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter src_ip="201.179.156.226"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688481,0.991147,010,0 0 0 0 0 0 1 1 0 0 0 0,poscaSYN">
        <slice>
            <filter src_ip="46.234.89.40" dst_ip="177.76.146.199"/>
            <filter src_ip="46.234.89.40" dst_ip="177.76.102.147"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688481,0.991147,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="62.230.166.238"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688481,0.991147,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="201.20.124.143" src_port="63990"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="201.20.114.31" dst_port="18299"/>
            <filter dst_ip="201.20.114.31" dst_port="47279"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="151.239.208.198"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.183.176.188" dst_port="33215"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.20.124.22" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.183.131.123" dst_port="6630"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="201.20.120.142"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.20.0.133" dst_port="25"/>
            <filter dst_ip="201.20.0.133" dst_port="29430"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.11.161.234" dst_port="16470"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.183.8.15" dst_port="39469"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="148.86.222.1" dst_port="16070"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688481,0.991147,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.52.97.78" src_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688481,0.991147,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="108.149.77.39" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.52.65.118" src_port="6851" dst_port="4672"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688481,0.991147,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.52.65.118" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688481,0.991147,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="116.139.105.38" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688481,0.991147,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="14.160.211.213" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914831,0.983561,999,0 0 0 1 1 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="161.11.161.234" src_port="26517"/>
            <filter src_ip="161.11.161.234" src_port="49153" dst_port="16470"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688481,0.991147,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="108.148.147.250" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688481,0.991147,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="46.88.219.100" src_port="80" dst_port="1234"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688481,0.991147,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="152.197.31.175" src_port="80" dst_port="1234"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688481,0.991147,011,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="2.100.61.171" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="161.11.0.47" src_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="161.11.251.145" src_port="21158"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.20.124.9" src_port="53"/>
            <filter dst_ip="201.20.124.9" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.239.222.25" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.239.222.26" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.20.120.234" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.20.120.233" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.20.115.81" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.20.115.85" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.20.115.78" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,503,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="98.141.112.73" dst_ip="148.86.199.194" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.20.126.136" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="161.11.232.236" dst_ip="136.80.228.90" src_port="123"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="164.250.47.90" dst_ip="77.232.89.219" src_port="53"/>
            <filter src_ip="164.250.46.210" dst_ip="77.232.89.219" src_port="53"/>
            <filter src_ip="164.250.46.60" dst_ip="77.232.89.219" src_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688481,0.991147,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.20.114.18" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637335"/>
        <to usec="0" sec="1341637381"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914831,0.983561,999,0 0 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="201.20.114.31" src_port="18299"/>
            <filter src_ip="201.20.114.18" src_port="18979"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,503,0 0 0 0 0 0 1 1 1 0 0 0,ntscACKt">
        <slice>
            <filter src_ip="201.20.124.9" src_port="80"/>
            <filter src_ip="201.20.124.9"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="116.139.10.151" src_port="6005" dst_port="3072"/>
            <filter src_ip="116.139.10.151" src_port="6005" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637831"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="194.129.82.50" src_port="6667" dst_port="3072"/>
            <filter src_ip="194.129.82.50" src_port="6667" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637831"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="201.20.124.90"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="62.230.166.238"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.732480,0.935513,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="161.11.232.236" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638024"/>
    </anomaly>
    <anomaly type="suspicious" value="0.732480,0.935513,010,0 0 0 1 0 0 1 1 1 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="138.114.117.84" dst_ip="151.239.222.81" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637848"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="98.102.247.95" src_port="21"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.732480,0.935513,503,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="200.57.160.166" dst_port="80"/>
            <filter src_ip="200.52.65.118" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637927"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,503,0 0 0 0 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="151.239.63.24" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter src_ip="200.57.67.176"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.20.114.19"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="151.239.36.214" dst_port="18751"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="49.29.119.121"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.20.0.133" dst_port="29430"/>
            <filter dst_ip="201.20.0.133" dst_port="25"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.183.8.15" dst_port="39469"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.57.72.194" dst_port="24498"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="148.86.222.1" dst_port="16070"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.57.67.182"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.732480,0.935513,999,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="161.11.134.1" dst_ip="33.252.137.76"/>
            <filter src_ip="161.11.134.1" dst_port="53"/>
            <filter src_ip="161.11.134.2" dst_ip="33.252.137.76"/>
            <filter src_ip="161.11.134.2" dst_port="53"/>
            <filter dst_ip="33.252.137.76" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638026"/>
    </anomaly>
    <anomaly type="suspicious" value="0.732480,0.935513,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.52.97.78" src_port="53"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637804"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="108.149.77.39" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="212.42.106.43" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.52.65.118" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688481,0.991147,504,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="200.52.65.118" dst_ip="19.17.196.44" dst_port="443"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="116.139.105.38" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="49.29.119.121" dst_port="445"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.732480,0.935513,010,0 0 0 1 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="14.160.211.213" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637848"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="161.11.134.77" src_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="108.148.147.250" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="46.88.219.100" src_port="80" dst_port="1234"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,010,0 0 0 0 0 0 1 1 1 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="217.159.70.7" dst_ip="201.20.114.18" dst_port="3124"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="161.11.0.47" src_port="53"/>
        </slice>
        <from usec="0" sec="1341637335"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914831,0.983561,999,0 0 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="151.239.238.208" dst_port="53"/>
            <filter dst_ip="192.44.239.8" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.20.114.18" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.183.156.45" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.20.124.9" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.183.156.44" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.732480,0.935513,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.20.125.66" src_port="53"/>
            <filter dst_ip="151.239.238.208" src_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.239.222.25" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.239.222.26" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.20.120.239" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.20.120.234" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,503,0 0 0 0 0 0 1 1 1 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="200.6.122.56" dst_ip="161.17.218.30" src_port="80"/>
            <filter src_ip="200.6.111.58" dst_ip="161.17.218.30" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.20.115.76" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.20.115.78" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.20.126.136" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.11.0.47" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.732480,0.935513,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.57.67.176" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="164.250.47.90" dst_ip="141.9.17.30" src_port="53"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="151.239.238.208" dst_ip="213.73.173.238" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="164.250.46.210" dst_ip="141.9.17.30" src_port="53"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="164.250.46.60" dst_ip="141.9.17.30" src_port="53"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="201.20.124.179" dst_port="51413"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637876"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="200.57.72.194" src_port="24498"/>
        </slice>
        <from usec="0" sec="1341637785"/>
        <to usec="0" sec="1341637876"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791312,0.977739,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="201.20.114.18" dst_port="53"/>
            <filter dst_ip="201.20.114.18" dst_port="18979"/>
            <filter dst_ip="201.20.114.18"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637876"/>
    </anomaly>
    <anomaly type="anomalous" value="2.707630,2.234260,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="212.109.225.158" src_port="62157" dst_port="22"/>
        </slice>
        <from usec="0" sec="1341638088"/>
        <to usec="0" sec="1341638090"/>
    </anomaly>
    <anomaly type="anomalous" value="2.769410,2.199620,010,1 1 1 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="220.42.144.13" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1341637650"/>
        <to usec="0" sec="1341637696"/>
    </anomaly>
    <anomaly type="anomalous" value="2.706680,2.199120,010,1 1 1 1 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="4.153.245.135" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="anomalous" value="1.834460,1.565500,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="49.29.119.121" dst_port="445"/>
        </slice>
        <from usec="0" sec="1341637628"/>
        <to usec="0" sec="1341637640"/>
    </anomaly>
    <anomaly type="anomalous" value="2.268470,1.814240,503,1 1 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="201.20.115.124" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="anomalous" value="1.551410,1.340380,999,0 0 0 1 1 1 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="151.239.33.66" src_port="58314"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="anomalous" value="3.074140,2.383060,999,1 1 1 1 1 1 1 1 1 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="192.88.93.220"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638074"/>
    </anomaly>
    <anomaly type="anomalous" value="1.438230,1.396500,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="165.110.58.207" dst_ip="42.241.244.110" src_port="80"/>
            <filter src_ip="165.110.58.207" dst_ip="42.241.242.81" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637585"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
    <anomaly type="anomalous" value="2.341860,1.771400,503,1 1 0 1 1 1 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.20.115.124" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638090"/>
    </anomaly>
    <anomaly type="anomalous" value="1.438230,1.396500,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="161.20.74.5" dst_ip="212.170.230.202" src_port="80" dst_port="46285"/>
            <filter src_ip="161.20.74.5" dst_ip="212.170.230.202" src_port="80" dst_port="36781"/>
            <filter src_ip="165.110.218.86" dst_ip="212.170.230.202" src_port="80" dst_port="63248"/>
            <filter src_ip="161.20.150.76" dst_ip="212.170.230.202" src_port="80" dst_port="34188"/>
        </slice>
        <from usec="0" sec="1341637202"/>
        <to usec="0" sec="1341637488"/>
    </anomaly>
    <anomaly type="anomalous" value="1.824620,1.460260,503,1 0 0 1 1 1 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="201.20.121.99" dst_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638090"/>
    </anomaly>
    <anomaly type="anomalous" value="1.438230,1.396500,503,0 0 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="161.11.80.118" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637842"/>
    </anomaly>
    <anomaly type="anomalous" value="1.551410,1.340380,503,0 0 0 1 1 1 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="200.57.162.252" dst_port="80"/>
            <filter src_ip="200.57.162.252" dst_port="443"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638015"/>
    </anomaly>
    <anomaly type="anomalous" value="1.438230,1.396500,999,0 0 0 1 1 1 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="185.3.15.173" dst_ip="42.241.242.48"/>
            <filter src_ip="185.3.15.173" dst_ip="42.241.244.161" src_port="80"/>
            <filter src_ip="185.3.15.173" dst_ip="212.170.230.114" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637204"/>
        <to usec="0" sec="1341637728"/>
    </anomaly>
    <anomaly type="anomalous" value="1.978480,1.519410,999,1 1 0 1 1 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="201.20.136.21" src_port="63591"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638088"/>
    </anomaly>
    <anomaly type="anomalous" value="3.074140,2.383060,503,1 1 1 1 1 1 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="200.52.96.164" dst_port="80"/>
            <filter src_ip="200.52.96.164" dst_port="53"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638090"/>
    </anomaly>
    <anomaly type="anomalous" value="1.244400,1.136540,020,1 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="201.20.121.47" dst_port="53"/>
            <filter src_ip="201.20.121.47"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638074"/>
    </anomaly>
    <anomaly type="anomalous" value="3.074140,2.383060,999,1 1 1 1 1 1 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="164.250.21.78" dst_ip="46.146.84.89"/>
            <filter src_ip="164.250.21.79" dst_ip="46.146.84.89"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341637831"/>
    </anomaly>
    <anomaly type="anomalous" value="1.551410,1.340380,503,0 0 0 1 1 1 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.57.162.252" src_port="80"/>
        </slice>
        <from usec="0" sec="1341637200"/>
        <to usec="0" sec="1341638028"/>
    </anomaly>
</admd:annotation>
