<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.824370,1.570260,503,1 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="205.79.96.229" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.669940,2.038820,503,1 1 1 1 1 1 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="164.141.136.41" dst_ip="50.204.191.140" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.275980,1.608550,503,1 1 0 1 1 0 1 1 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="204.75.71.7" dst_port="80"/>
            <filter src_ip="204.69.63.13" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.336120,2.085480,020,1 1 1 0 0 0 1 1 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="72.211.193.62"/>
        </slice>
        <from usec="0" sec="1349845650"/>
        <to usec="0" sec="1349845696"/>
    </anomaly>
    <anomaly type="anomalous" value="3.062820,2.157870,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="72.211.193.62" src_port="6000" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.974460,1.940090,010,1 1 1 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="134.237.236.137" src_port="80"/>
        </slice>
        <from usec="0" sec="1349845695"/>
        <to usec="0" sec="1349845741"/>
    </anomaly>
    <anomaly type="anomalous" value="2.385100,1.751580,999,0 0 0 1 1 1 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="134.16.64.171" dst_ip="205.79.102.13"/>
            <filter src_ip="92.134.163.56" dst_ip="205.79.102.13"/>
            <filter src_ip="216.191.61.81" dst_ip="205.79.102.13" src_port="21001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.409330,1.717310,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="205.79.96.202" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.007700,1.630690,503,1 1 0 1 1 1 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="204.75.121.34" src_port="80"/>
        </slice>
        <from usec="0" sec="1349845200"/>
        <to usec="0" sec="1349846101"/>
    </anomaly>
    <anomaly type="anomalous" value="1.485370,1.425570,503,1 1 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="205.79.97.18" dst_port="80"/>
            <filter dst_ip="196.196.124.75" dst_port="80"/>
            <filter dst_ip="196.196.126.55" dst_port="80"/>
        </slice>
        <from usec="0" sec="1349845200"/>
        <to usec="0" sec="1349846080"/>
    </anomaly>
    <anomaly type="anomalous" value="2.625850,1.992230,503,1 1 1 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="201.254.14.50" dst_port="80"/>
            <filter src_ip="164.17.147.33" dst_ip="201.254.14.10" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.524970,1.734240,011,1 1 0 1 1 1 0 0 0 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="218.8.10.142" src_port="1433" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.940430,1.617870,503,1 1 0 1 1 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="137.177.42.33" dst_port="80"/>
            <filter dst_ip="137.177.42.34" dst_port="80"/>
        </slice>
        <from usec="0" sec="1349845200"/>
        <to usec="0" sec="1349846097"/>
    </anomaly>
    <anomaly type="anomalous" value="2.754120,2.203040,503,1 1 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="205.79.97.18" dst_port="80"/>
            <filter dst_ip="205.79.110.19" src_port="80"/>
        </slice>
        <from usec="0" sec="1349845200"/>
        <to usec="0" sec="1349846067"/>
    </anomaly>
    <anomaly type="anomalous" value="2.024270,1.621400,999,0 0 0 1 1 1 0 0 0 1 1 0,ptpposcaUDP">
        <slice>
            <filter src_ip="185.219.109.118" dst_ip="43.0.116.76" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.637940,1.630650,999,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="137.177.140.52" dst_port="6922"/>
        </slice>
        <from usec="0" sec="1349845200"/>
        <to usec="0" sec="1349846028"/>
    </anomaly>
    <anomaly type="anomalous" value="2.623810,2.036890,503,1 1 1 1 1 1 1 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="204.75.120.34" dst_port="80"/>
            <filter src_ip="204.75.120.34" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.786680,1.600160,503,0 0 0 1 1 1 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="162.159.134.145" src_port="80"/>
            <filter src_ip="164.149.69.248" dst_ip="213.230.111.150" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.647930,1.390590,503,1 1 0 1 1 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="162.159.226.116" dst_port="80"/>
            <filter dst_ip="153.172.165.18" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.633090,2.235350,999,1 1 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="205.79.106.20" dst_port="53"/>
            <filter dst_ip="205.79.106.16" dst_port="53"/>
            <filter dst_ip="204.69.156.180" src_port="53"/>
        </slice>
        <from usec="0" sec="1349845200"/>
        <to usec="0" sec="1349845779"/>
    </anomaly>
    <anomaly type="anomalous" value="1.924590,1.568630,503,1 0 0 1 1 0 1 1 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="52.32.185.212" dst_port="80"/>
            <filter dst_ip="52.32.185.212" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.499280,2.248830,010,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="43.73.250.121" dst_ip="204.129.116.131" src_port="139"/>
        </slice>
        <from usec="0" sec="1349845200"/>
        <to usec="0" sec="1349845246"/>
    </anomaly>
    <anomaly type="anomalous" value="2.845080,2.180560,503,1 1 0 1 1 0 1 1 1 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="144.45.73.126" dst_ip="205.79.107.250" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.057530,2.307230,503,1 0 0 1 1 1 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="162.159.209.116" dst_port="80"/>
            <filter dst_ip="153.172.163.183" dst_port="80"/>
            <filter dst_ip="153.172.163.183" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.523570,2.426780,503,1 1 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="204.69.63.13" src_port="80"/>
            <filter dst_ip="204.69.63.13" src_port="443"/>
            <filter dst_ip="205.79.98.128" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.995080,1.523900,503,1 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="205.79.96.229" src_port="80"/>
            <filter src_ip="205.79.96.230" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.832860,1.896050,503,1 0 0 1 1 1 1 1 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="205.79.107.250" dst_ip="144.45.73.126" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.542860,1.734850,503,1 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="164.144.174.139" src_port="80"/>
            <filter src_ip="48.183.223.254" src_port="80" dst_port="1234"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.441650,2.414710,503,1 0 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="51.151.95.137" src_port="80"/>
            <filter dst_ip="204.69.62.150" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.385100,1.751580,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="204.69.63.135" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.507690,1.414930,503,0 0 0 1 1 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="205.79.96.230" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.254380,2.293990,503,1 1 0 1 1 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="205.79.96.202" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.385100,1.751580,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="185.219.139.138" dst_ip="52.21.182.154" src_port="80"/>
            <filter src_ip="185.219.139.138" dst_ip="213.230.111.208" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.545740,1.372290,503,1 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="204.75.120.131" src_port="80"/>
            <filter dst_ip="43.0.116.52" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.772120,1.566730,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="137.177.136.0" src_port="80"/>
            <filter dst_ip="137.177.136.0" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.974570,1.588750,503,1 1 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="204.69.136.104" dst_port="80"/>
            <filter src_ip="204.69.136.138" dst_ip="197.236.162.24"/>
            <filter src_ip="204.69.136.138" dst_port="80"/>
            <filter dst_ip="197.236.162.24" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.385100,1.751580,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="69.182.52.193" dst_ip="137.177.84.82"/>
            <filter src_ip="69.182.52.193" src_port="80"/>
            <filter src_ip="69.182.52.193" src_port="443"/>
            <filter dst_ip="137.177.84.82" src_port="443"/>
            <filter src_ip="212.56.0.197" dst_ip="137.177.84.82" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.652680,1.751610,503,1 1 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="162.159.27.23" src_port="80"/>
            <filter dst_ip="137.177.84.241" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.792250,1.607660,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="137.177.222.109" src_port="443"/>
            <filter dst_ip="137.177.222.109" src_port="80"/>
            <filter src_ip="38.215.57.63" dst_ip="137.177.222.109" src_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.140160,1.882390,010,1 1 1 1 0 0 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="51.46.77.121" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.772120,1.566730,503,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="137.177.243.54" src_port="80"/>
            <filter dst_ip="137.177.236.114" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.952900,2.143800,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="218.8.10.142" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.049040,2.284180,503,1 0 0 1 0 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="204.69.60.26" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.523570,2.426780,503,1 1 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="204.75.71.7" src_port="80"/>
            <filter dst_ip="204.75.71.7" src_port="53"/>
            <filter dst_ip="204.69.144.87" dst_port="24498"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.799230,1.924420,999,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="147.156.73.85" dst_ip="204.75.71.97" src_port="2569" dst_port="25"/>
            <filter src_ip="98.221.174.135" dst_ip="204.75.71.97" src_port="60656" dst_port="25"/>
            <filter src_ip="131.106.204.59" dst_ip="204.75.71.97" src_port="56750" dst_port="25"/>
        </slice>
        <from usec="0" sec="1349845732"/>
        <to usec="0" sec="1349845746"/>
    </anomaly>
    <anomaly type="suspicious" value="1.799230,1.924420,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="72.175.10.189" dst_port="53"/>
        </slice>
        <from usec="0" sec="1349845804"/>
        <to usec="0" sec="1349846082"/>
    </anomaly>
    <anomaly type="suspicious" value="1.799230,1.924420,999,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="204.75.121.48" dst_ip="56.167.206.41" src_port="53"/>
            <filter src_ip="204.75.121.7" dst_ip="56.167.206.41" src_port="53"/>
            <filter src_ip="204.75.121.4" dst_ip="56.167.206.41" src_port="53"/>
        </slice>
        <from usec="0" sec="1349845279"/>
        <to usec="0" sec="1349845769"/>
    </anomaly>
    <anomaly type="suspicious" value="1.246720,1.475020,999,1 1 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="204.75.121.7" dst_ip="58.128.76.92" src_port="53"/>
            <filter src_ip="204.75.121.4" dst_ip="58.128.76.92" src_port="53"/>
            <filter src_ip="204.75.121.48" dst_ip="58.128.76.92" src_port="53"/>
        </slice>
        <from usec="0" sec="1349845380"/>
        <to usec="0" sec="1349846094"/>
    </anomaly>
    <anomaly type="suspicious" value="1.799230,1.924420,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="47.118.100.189" src_port="22" dst_port="35626"/>
        </slice>
        <from usec="0" sec="1349845597"/>
        <to usec="0" sec="1349845599"/>
    </anomaly>
    <anomaly type="suspicious" value="1.799230,1.924420,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="172.20.32.48" src_port="2425" dst_port="2425"/>
        </slice>
        <from usec="0" sec="1349845306"/>
        <to usec="0" sec="1349845419"/>
    </anomaly>
    <anomaly type="suspicious" value="1.246720,1.475020,002,1 1 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="32.56.217.91" src_port="1025" dst_port="137"/>
        </slice>
        <from usec="0" sec="1349845695"/>
        <to usec="0" sec="1349845741"/>
    </anomaly>
    <anomaly type="suspicious" value="1.246720,1.475020,002,1 1 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="32.57.104.255" src_port="1026" dst_port="137"/>
        </slice>
        <from usec="0" sec="1349845425"/>
        <to usec="0" sec="1349845471"/>
    </anomaly>
    <anomaly type="suspicious" value="1.799230,1.924420,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="46.73.201.24" dst_port="445"/>
            <filter src_ip="46.73.201.24" dst_port="139"/>
        </slice>
        <from usec="0" sec="1349845476"/>
        <to usec="0" sec="1349845519"/>
    </anomaly>
    <anomaly type="suspicious" value="1.779180,1.890370,502,1 1 1 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="122.102.97.32" dst_port="22"/>
            <filter src_ip="41.93.112.185" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1349845201"/>
        <to usec="0" sec="1349846101"/>
    </anomaly>
    <anomaly type="suspicious" value="1.243010,1.404170,504,1 1 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="50.74.21.232" dst_port="443"/>
        </slice>
        <from usec="0" sec="1349845201"/>
        <to usec="0" sec="1349845650"/>
    </anomaly>
    <anomaly type="suspicious" value="1.534530,1.640570,999,0 0 0 1 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="138.169.142.62" src_port="53"/>
            <filter dst_ip="138.169.142.63" src_port="53"/>
        </slice>
        <from usec="0" sec="1349845200"/>
        <to usec="0" sec="1349845913"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557730,1.679700,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="205.79.111.199" dst_ip="55.53.244.193" dst_port="80"/>
        </slice>
        <from usec="0" sec="1349845200"/>
        <to usec="0" sec="1349845246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557730,1.679700,503,0 0 0 0 0 0 1 1 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="205.67.246.233" dst_ip="137.177.168.86" src_port="80"/>
            <filter src_ip="205.67.240.205" dst_ip="137.177.168.86" src_port="80"/>
        </slice>
        <from usec="0" sec="1349845200"/>
        <to usec="0" sec="1349845246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557730,1.679700,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="164.141.68.160" src_port="16026"/>
        </slice>
        <from usec="0" sec="1349845425"/>
        <to usec="0" sec="1349845561"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557730,1.679700,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="138.169.142.63" src_port="53"/>
        </slice>
        <from usec="0" sec="1349845695"/>
        <to usec="0" sec="1349845741"/>
    </anomaly>
    <anomaly type="suspicious" value="1.153540,1.373570,503,1 1 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="204.69.137.137" dst_ip="201.150.145.66"/>
            <filter src_ip="204.69.137.137" dst_port="80"/>
            <filter src_ip="137.177.153.80" dst_ip="201.150.145.66" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.318070,1.423590,504,1 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="137.177.86.10" dst_ip="52.227.192.61" src_port="49650" dst_port="443"/>
            <filter src_ip="164.141.140.39" dst_ip="52.227.192.61" src_port="61824" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.244740,1.419700,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="163.97.248.142" dst_ip="52.21.180.92" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.480440,1.484550,504,0 1 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="164.141.53.108" dst_ip="116.109.133.255" src_port="51645" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.273240,1.464740,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="164.17.216.172" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.273240,1.464740,999,0 0 0 0 0 0 0 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="205.79.110.140" dst_port="51413"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.290560,1.377210,503,1 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="137.177.170.130" src_port="80"/>
            <filter dst_ip="162.159.93.16" src_port="80"/>
            <filter dst_ip="162.159.93.16" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.273240,1.464740,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="59.128.199.83" dst_ip="205.79.105.101" src_port="1935" dst_port="57223"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.273240,1.464740,053,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="214.65.227.113" dst_ip="137.177.143.113" src_port="80"/>
            <filter src_ip="214.65.227.114" dst_ip="137.177.143.113" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.273240,1.464740,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="205.79.98.128" dst_ip="148.182.180.2" src_port="61235" dst_port="80"/>
            <filter src_ip="205.79.98.128" dst_ip="148.182.180.2" src_port="61234" dst_port="80"/>
            <filter src_ip="205.79.98.128" dst_ip="148.182.180.2" src_port="61226" dst_port="80"/>
            <filter src_ip="205.79.98.128" dst_ip="148.182.180.2" src_port="61225" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.779180,1.890370,010,1 1 1 1 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="33.93.167.31" src_port="6000" dst_port="4899"/>
        </slice>
        <from usec="0" sec="1349845289"/>
        <to usec="0" sec="1349846073"/>
    </anomaly>
    <anomaly type="suspicious" value="1.273240,1.464740,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="92.141.150.7" src_port="80"/>
            <filter dst_ip="204.69.61.163" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.273240,1.464740,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="185.219.212.125" dst_ip="213.230.111.231" src_port="80"/>
            <filter src_ip="164.149.206.86" dst_ip="213.230.111.231" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
