<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.480260,1.418040,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.71.174.6" dst_ip="214.94.79.169" src_port="54682" dst_port="80"/>
        </slice>
        <from usec="0" sec="1344402736"/>
        <to usec="0" sec="1344402739"/>
    </anomaly>
    <anomaly type="anomalous" value="1.979820,1.600900,010,1 1 1 0 0 0 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="123.47.13.55" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.195980,1.539930,503,1 1 1 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="201.85.87.151" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.555280,1.453980,010,1 1 1 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="149.81.137.132" src_port="80"/>
        </slice>
        <from usec="0" sec="1344402000"/>
        <to usec="0" sec="1344402046"/>
    </anomaly>
    <anomaly type="anomalous" value="1.480260,1.418040,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="138.143.187.232" dst_port="23"/>
        </slice>
        <from usec="0" sec="1344402736"/>
        <to usec="0" sec="1344402739"/>
    </anomaly>
    <anomaly type="anomalous" value="1.480260,1.418040,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.68.195.227" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1344402149"/>
        <to usec="0" sec="1344402152"/>
    </anomaly>
    <anomaly type="anomalous" value="1.698620,1.278240,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="222.38.212.224" dst_ip="135.84.25.69" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.543390,1.297150,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="189.11.107.134" dst_ip="50.185.112.180" src_port="80"/>
        </slice>
        <from usec="0" sec="1344402021"/>
        <to usec="0" sec="1344402088"/>
    </anomaly>
    <anomaly type="anomalous" value="1.543390,1.297150,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="192.62.205.194" dst_ip="135.84.87.142" src_port="80"/>
            <filter src_ip="91.163.203.166" dst_ip="135.84.87.142" src_port="80"/>
        </slice>
        <from usec="0" sec="1344402000"/>
        <to usec="0" sec="1344402198"/>
    </anomaly>
    <anomaly type="anomalous" value="1.698620,1.278240,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="135.84.71.136" dst_ip="142.179.113.221" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.698620,1.278240,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="91.163.237.34" src_port="80"/>
            <filter dst_ip="200.169.97.242" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.951210,1.369710,503,1 1 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="201.85.87.151" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.086950,1.490410,999,1 0 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="163.87.42.65" dst_ip="215.125.6.89"/>
            <filter src_ip="163.87.42.65" src_port="520"/>
            <filter src_ip="163.87.42.73" dst_ip="215.125.6.89"/>
            <filter src_ip="163.87.42.73" src_port="520"/>
            <filter dst_ip="215.125.6.89" src_port="520"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.769200,1.273030,503,1 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="201.85.93.145" dst_ip="150.61.73.220" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.769200,1.273030,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="52.219.36.115" src_port="80"/>
            <filter dst_ip="164.206.4.42" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.641470,1.400770,503,1 1 1 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="135.84.24.237" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.459190,1.723980,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="8.192.234.210" src_port="29112" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.054430,1.203210,999,1 1 0 0 0 0 0 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="201.85.167.70" src_port="52180" dst_port="3544"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.965022,1.236470,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="123.47.13.55" dst_ip="123.47.13.55" proto="icmp"/>
        </slice>
        <from usec="0" sec="1344402752"/>
        <to usec="0" sec="1344402759"/>
    </anomaly>
    <anomaly type="suspicious" value="1.084450,1.231080,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="20.96.161.127" dst_port="137"/>
        </slice>
        <from usec="0" sec="1344402401"/>
        <to usec="0" sec="1344402416"/>
    </anomaly>
    <anomaly type="suspicious" value="1.216310,1.368970,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="200.67.170.161" src_port="53" dst_port="1001"/>
        </slice>
        <from usec="0" sec="1344402405"/>
        <to usec="0" sec="1344402766"/>
    </anomaly>
    <anomaly type="suspicious" value="1.216310,1.368970,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="136.146.6.114" dst_ip="132.110.200.86" dst_port="520"/>
            <filter src_ip="136.146.6.114" dst_ip="132.110.145.224" dst_port="520"/>
            <filter src_ip="136.146.6.114" dst_ip="132.110.145.227" dst_port="520"/>
        </slice>
        <from usec="0" sec="1344402000"/>
        <to usec="0" sec="1344402046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.288400,1.339010,999,1 0 0 0 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="136.167.82.147" dst_ip="132.110.145.224"/>
            <filter src_ip="136.167.82.147" dst_ip="132.110.200.86"/>
            <filter src_ip="136.167.82.147" dst_ip="132.110.145.227"/>
            <filter src_ip="136.167.82.147" dst_port="520"/>
            <filter dst_ip="132.110.145.224" dst_port="520"/>
            <filter dst_ip="132.110.200.86" dst_port="520"/>
            <filter dst_ip="132.110.145.227" dst_port="520"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.980483,1.270360,999,0 0 0 0 0 0 1 1 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="53.160.92.243" dst_ip="132.110.145.224" dst_port="520"/>
            <filter src_ip="53.160.92.243" dst_ip="132.110.145.227" dst_port="520"/>
            <filter src_ip="53.160.92.243" dst_ip="132.110.200.86" dst_port="520"/>
        </slice>
        <from usec="0" sec="1344402000"/>
        <to usec="0" sec="1344402046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.216310,1.368970,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="144.193.202.74" dst_ip="132.110.145.224" dst_port="520"/>
            <filter src_ip="144.193.202.74" dst_ip="132.110.145.227" dst_port="520"/>
            <filter src_ip="144.193.202.74" dst_ip="132.110.200.86" dst_port="520"/>
        </slice>
        <from usec="0" sec="1344402000"/>
        <to usec="0" sec="1344402046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.216310,1.368970,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="163.87.142.83" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1344402000"/>
        <to usec="0" sec="1344402766"/>
    </anomaly>
    <anomaly type="suspicious" value="1.216310,1.368970,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="124.10.108.99" src_port="4340" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1344402405"/>
        <to usec="0" sec="1344402451"/>
    </anomaly>
    <anomaly type="suspicious" value="1.216310,1.368970,010,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="4935" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1344402405"/>
        <to usec="0" sec="1344402451"/>
    </anomaly>
    <anomaly type="suspicious" value="1.216310,1.368970,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="81.251.224.55" dst_ip="132.110.200.86" dst_port="520"/>
            <filter src_ip="81.251.224.55" dst_ip="132.110.145.224" dst_port="520"/>
            <filter src_ip="81.251.224.55" dst_ip="132.110.145.227" dst_port="520"/>
        </slice>
        <from usec="0" sec="1344402450"/>
        <to usec="0" sec="1344402496"/>
    </anomaly>
    <anomaly type="suspicious" value="1.216310,1.368970,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="124.10.108.99" src_port="4340" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1344402720"/>
        <to usec="0" sec="1344402766"/>
    </anomaly>
    <anomaly type="suspicious" value="1.216310,1.368970,010,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="4935" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1344402720"/>
        <to usec="0" sec="1344402766"/>
    </anomaly>
    <anomaly type="suspicious" value="1.118790,1.330740,999,0 0 0 0 0 0 0 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="52.166.163.146" dst_ip="132.110.200.86" dst_port="520"/>
        </slice>
        <from usec="0" sec="1344402765"/>
        <to usec="0" sec="1344402811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870270,1.106640,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="163.87.105.46" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870270,1.106640,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="201.85.87.166" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870270,1.106640,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="163.71.237.179" dst_ip="50.185.117.146"/>
            <filter src_ip="163.71.237.179" src_port="80"/>
            <filter dst_ip="50.185.117.146" src_port="80"/>
            <filter src_ip="163.71.237.179" dst_ip="50.185.112.69" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870270,1.106640,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="200.167.18.73" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870270,1.106640,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="201.85.87.166" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870270,1.106640,999,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="200.169.169.207" dst_port="27391"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001070,1.100620,503,1 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="150.61.73.220" dst_ip="201.85.93.145" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870270,1.106640,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="164.206.141.127" src_port="80"/>
            <filter dst_ip="164.206.141.127" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001070,1.100620,503,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="91.163.203.132" dst_ip="135.84.61.106" src_port="80"/>
            <filter src_ip="91.163.203.136" dst_ip="132.110.232.204" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001070,1.100620,011,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="8.192.234.210" src_port="22" dst_port="29112"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
