<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.616650,1.326020,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="145.5.58.111" dst_ip="19.201.104.100" src_port="50403" dst_port="80"/>
            <filter src_ip="145.5.58.111" dst_ip="19.201.104.100" src_port="50400" dst_port="80"/>
        </slice>
        <from usec="0" sec="1347167126"/>
        <to usec="0" sec="1347167138"/>
    </anomaly>
    <anomaly type="anomalous" value="1.232570,1.072680,020,1 1 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="39.203.240.190"/>
        </slice>
        <from usec="0" sec="1347167296"/>
        <to usec="0" sec="1347167387"/>
    </anomaly>
    <anomaly type="anomalous" value="1.616650,1.326020,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="223.10.228.107" src_port="8888" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1347167639"/>
        <to usec="0" sec="1347167664"/>
    </anomaly>
    <anomaly type="anomalous" value="1.616650,1.326020,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="207.248.112.185" src_port="6000" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1347167521"/>
        <to usec="0" sec="1347167523"/>
    </anomaly>
    <anomaly type="anomalous" value="1.197520,1.086110,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="39.203.240.190" dst_port="445"/>
            <filter src_ip="39.203.240.190" dst_port="139"/>
        </slice>
        <from usec="0" sec="1347167308"/>
        <to usec="0" sec="1347167353"/>
    </anomaly>
    <anomaly type="anomalous" value="1.488310,1.178380,999,1 1 0 1 1 1 0 0 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="194.100.66.27"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347167629"/>
    </anomaly>
    <anomaly type="anomalous" value="1.516660,1.166010,503,1 1 0 1 1 1 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.75.234.38" dst_port="80"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347167698"/>
    </anomaly>
    <anomaly type="anomalous" value="1.865410,1.392220,999,1 1 1 1 1 1 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="206.75.51.24" src_port="52180"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347167701"/>
    </anomaly>
    <anomaly type="anomalous" value="1.488310,1.178380,503,1 1 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="206.75.234.38" src_port="80"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347167698"/>
    </anomaly>
    <anomaly type="anomalous" value="1.842440,1.402590,503,1 1 1 1 1 1 0 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="206.75.231.33" dst_ip="136.34.9.62" src_port="80"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347167682"/>
    </anomaly>
    <anomaly type="anomalous" value="1.840210,1.403420,010,1 1 1 1 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="45.243.223.112" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347167027"/>
    </anomaly>
    <anomaly type="anomalous" value="1.597800,1.216760,503,1 1 0 1 1 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="207.9.83.125" src_port="80"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347167701"/>
    </anomaly>
    <anomaly type="anomalous" value="1.614010,1.488590,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="206.75.235.84" src_port="18240"/>
            <filter src_ip="206.75.235.84"/>
        </slice>
        <from usec="0" sec="1347166936"/>
        <to usec="0" sec="1347167207"/>
    </anomaly>
    <anomaly type="anomalous" value="1.614010,1.488590,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="207.128.226.174" src_port="53" dst_port="1001"/>
        </slice>
        <from usec="0" sec="1347166936"/>
        <to usec="0" sec="1347167162"/>
    </anomaly>
    <anomaly type="anomalous" value="1.614010,1.488590,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="181.172.5.171" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347167207"/>
    </anomaly>
    <anomaly type="anomalous" value="2.211310,1.713080,010,1 1 1 1 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.73.0.66" dst_port="80"/>
            <filter src_ip="1.73.0.66" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1347166837"/>
        <to usec="0" sec="1347167519"/>
    </anomaly>
    <anomaly type="anomalous" value="1.515590,1.226670,999,1 1 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="172.20.32.48" src_port="2425" dst_port="2425"/>
        </slice>
        <from usec="0" sec="1347166981"/>
        <to usec="0" sec="1347167162"/>
    </anomaly>
    <anomaly type="suspicious" value="0.890445,1.018200,010,1 0 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="220.67.68.223" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1347167619"/>
        <to usec="0" sec="1347167623"/>
    </anomaly>
    <anomaly type="suspicious" value="0.890445,1.018200,010,1 0 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="47.122.144.43" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1347167681"/>
        <to usec="0" sec="1347167682"/>
    </anomaly>
    <anomaly type="suspicious" value="0.703240,0.949477,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="173.30.168.147" dst_ip="211.118.20.231" src_port="80"/>
            <filter src_ip="173.30.168.147" dst_ip="4.188.97.95" src_port="80"/>
        </slice>
        <from usec="0" sec="1347166813"/>
        <to usec="0" sec="1347167174"/>
    </anomaly>
    <anomaly type="suspicious" value="0.761388,0.934082,503,0 0 0 1 1 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.75.234.24" dst_port="80"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347167359"/>
    </anomaly>
    <anomaly type="suspicious" value="0.703240,0.949477,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="216.197.92.114" dst_ip="145.5.17.161" src_port="12043"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347166999"/>
    </anomaly>
    <anomaly type="suspicious" value="1.009750,1.065210,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="181.172.157.214" dst_ip="203.68.186.108" src_port="80" dst_port="43017"/>
            <filter src_ip="181.172.157.214" dst_ip="203.68.186.108" src_port="80" dst_port="41305"/>
            <filter src_ip="181.172.157.214" dst_ip="203.68.186.108" src_port="80" dst_port="41271"/>
            <filter src_ip="181.172.157.214" dst_ip="203.68.186.108" src_port="80" dst_port="40139"/>
        </slice>
        <from usec="0" sec="1347166806"/>
        <to usec="0" sec="1347166909"/>
    </anomaly>
    <anomaly type="suspicious" value="1.009750,1.065210,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="173.30.212.0" dst_ip="4.188.97.83" src_port="80"/>
        </slice>
        <from usec="0" sec="1347166814"/>
        <to usec="0" sec="1347166902"/>
    </anomaly>
    <anomaly type="suspicious" value="1.009750,1.065210,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="181.172.157.214" dst_ip="11.41.19.151" src_port="80"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347167449"/>
    </anomaly>
    <anomaly type="suspicious" value="0.703240,0.949477,504,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="145.5.16.129" dst_ip="129.154.200.83" dst_port="443"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347167179"/>
    </anomaly>
    <anomaly type="suspicious" value="1.009750,1.065210,503,0 0 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="206.75.234.24" src_port="80"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347167629"/>
    </anomaly>
    <anomaly type="suspicious" value="0.703240,0.949477,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="1.78.118.209" dst_ip="207.0.81.85" src_port="443" dst_port="61919"/>
        </slice>
        <from usec="0" sec="1347166851"/>
        <to usec="0" sec="1347167513"/>
    </anomaly>
    <anomaly type="suspicious" value="1.009750,1.065210,504,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="179.170.183.93" dst_ip="4.188.96.192" src_port="443"/>
        </slice>
        <from usec="0" sec="1347167130"/>
        <to usec="0" sec="1347167256"/>
    </anomaly>
    <anomaly type="suspicious" value="0.703240,0.949477,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="178.225.46.216" dst_ip="214.23.199.237" src_port="62859" dst_port="443"/>
            <filter src_ip="178.225.153.61" dst_ip="214.23.199.237" src_port="61543" dst_port="443"/>
            <filter src_ip="178.225.46.25" dst_ip="214.23.199.237" src_port="60027" dst_port="443"/>
        </slice>
        <from usec="0" sec="1347166803"/>
        <to usec="0" sec="1347167621"/>
    </anomaly>
    <anomaly type="suspicious" value="1.009750,1.065210,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="181.172.157.214" dst_ip="11.41.19.148" src_port="80"/>
        </slice>
        <from usec="0" sec="1347166805"/>
        <to usec="0" sec="1347167539"/>
    </anomaly>
    <anomaly type="suspicious" value="1.009750,1.065210,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="206.75.231.33" dst_ip="64.32.135.164" src_port="80" dst_port="34288"/>
            <filter src_ip="206.75.231.33" dst_ip="64.32.135.164" src_port="80" dst_port="34286"/>
        </slice>
        <from usec="0" sec="1347167485"/>
        <to usec="0" sec="1347167517"/>
    </anomaly>
    <anomaly type="suspicious" value="1.009750,1.065210,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="207.9.82.229" dst_ip="4.188.96.98" src_port="80" dst_port="42114"/>
        </slice>
        <from usec="0" sec="1347167371"/>
        <to usec="0" sec="1347167375"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764651,1.007650,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347167539"/>
    </anomaly>
    <anomaly type="suspicious" value="1.009750,1.065210,503,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="1.78.118.193" dst_ip="145.5.96.37"/>
            <filter src_ip="1.78.118.193" src_port="80"/>
            <filter src_ip="1.78.118.193" src_port="443"/>
            <filter dst_ip="145.5.96.37" src_port="443"/>
            <filter src_ip="197.123.20.97" dst_ip="145.5.96.37" src_port="80"/>
        </slice>
        <from usec="0" sec="1347166821"/>
        <to usec="0" sec="1347167628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.009750,1.065210,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="179.170.180.146" dst_ip="211.118.20.50" src_port="80" dst_port="36686"/>
        </slice>
        <from usec="0" sec="1347167534"/>
        <to usec="0" sec="1347167537"/>
    </anomaly>
    <anomaly type="suspicious" value="0.873850,1.076520,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347167539"/>
    </anomaly>
    <anomaly type="suspicious" value="1.051070,1.051510,503,0 0 0 1 1 1 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.34.9.62" dst_ip="206.75.231.33" dst_port="80"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347167629"/>
    </anomaly>
    <anomaly type="suspicious" value="1.049530,1.118400,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="207.0.86.251" src_port="24498"/>
        </slice>
        <from usec="0" sec="1347166801"/>
        <to usec="0" sec="1347166982"/>
    </anomaly>
    <anomaly type="suspicious" value="1.049530,1.118400,010,0 0 0 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_port="4935" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1347167116"/>
        <to usec="0" sec="1347167162"/>
    </anomaly>
    <anomaly type="suspicious" value="1.049530,1.118400,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.225.97.179" src_port="9929"/>
        </slice>
        <from usec="0" sec="1347167116"/>
        <to usec="0" sec="1347167207"/>
    </anomaly>
</admd:annotation>
