<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.329920,1.863940,020,1 1 1 1 1 1 0 0 0 0 1 0,icmp_error">
        <slice>
            <filter src_ip="215.49.97.65"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.463880,1.442430,053,1 1 1 1 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="15.33.140.69" dst_ip="169.27.5.117" src_port="80"/>
        </slice>
        <from usec="0" sec="1352610029"/>
        <to usec="0" sec="1352610783"/>
    </anomaly>
    <anomaly type="anomalous" value="1.482500,1.461330,999,1 1 1 0 0 0 0 0 0 0 0 0,ipv4gretun">
        <slice>
            <filter src_ip="174.172.178.21" dst_ip="215.129.50.44"/>
            <filter src_ip="174.172.178.21" dst_ip="215.129.50.44" src_port="123" dst_port="123"/>
            <filter src_ip="222.113.111.197" dst_ip="215.129.50.44"/>
        </slice>
        <from usec="0" sec="1352610159"/>
        <to usec="0" sec="1352610843"/>
    </anomaly>
    <anomaly type="anomalous" value="1.638120,1.459530,999,1 1 1 1 0 0 0 0 0 0 1 0,mptp">
        <slice>
            <filter dst_ip="130.30.156.160" src_port="80"/>
            <filter dst_ip="130.30.156.160" dst_port="16880"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.482500,1.461330,999,1 1 1 0 0 0 0 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="39.66.5.50" dst_ip="215.129.58.20" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1352610155"/>
        <to usec="0" sec="1352610898"/>
    </anomaly>
    <anomaly type="anomalous" value="2.624000,1.995110,010,1 1 1 1 1 1 1 0 0 0 1 1,ntscSYNt">
        <slice>
            <filter src_ip="203.22.10.226" src_port="31850" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.463880,1.442430,504,1 1 1 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="214.33.138.27" dst_ip="181.24.230.226" dst_port="443"/>
            <filter src_ip="214.33.138.27" dst_ip="139.114.126.55" dst_port="443"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610897"/>
    </anomaly>
    <anomaly type="anomalous" value="1.552170,1.423240,503,1 1 0 1 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="130.30.68.216" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610574"/>
        <to usec="0" sec="1352610721"/>
    </anomaly>
    <anomaly type="anomalous" value="3.502760,2.880370,020,1 1 1 0 0 0 1 1 1 0 1 1,ntscTCPICdurp">
        <slice>
            <filter dst_ip="203.22.10.226"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.482500,1.461330,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="147.84.131.73" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1352610238"/>
        <to usec="0" sec="1352610345"/>
    </anomaly>
    <anomaly type="anomalous" value="1.654780,1.478210,010,1 1 1 0 0 0 0 0 0 0 1 0,ntscSYNt">
        <slice>
            <filter src_ip="1.69.224.74" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.482500,1.461330,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="152.234.216.111" src_port="28872" dst_port="1433"/>
            <filter src_ip="152.234.216.111" src_port="28869" dst_port="8080"/>
            <filter src_ip="152.234.216.111" src_port="28867" dst_port="445"/>
            <filter src_ip="152.234.216.111" src_port="28865" dst_port="9090"/>
        </slice>
        <from usec="0" sec="1352610428"/>
        <to usec="0" sec="1352610433"/>
    </anomaly>
    <anomaly type="anomalous" value="1.482500,1.461330,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="37.68.8.251" src_port="25565"/>
        </slice>
        <from usec="0" sec="1352610070"/>
        <to usec="0" sec="1352610074"/>
    </anomaly>
    <anomaly type="anomalous" value="1.482500,1.461330,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="33.90.190.72" dst_port="23"/>
        </slice>
        <from usec="0" sec="1352610465"/>
        <to usec="0" sec="1352610468"/>
    </anomaly>
    <anomaly type="anomalous" value="1.691070,1.504050,999,1 1 1 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="130.30.156.160" src_port="16880"/>
            <filter src_ip="130.30.156.160" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610900"/>
    </anomaly>
    <anomaly type="anomalous" value="1.843970,1.520460,502,1 1 1 1 1 0 0 0 0 0 1 0,ptmp">
        <slice>
            <filter src_ip="57.27.113.17" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.122800,1.715330,503,1 0 0 1 1 1 0 0 0 0 1 1,heavy_hitter">
        <slice>
            <filter src_ip="215.129.50.232" dst_ip="144.213.162.161" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.574160,1.334120,503,1 0 0 1 1 0 0 0 0 0 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="215.129.57.56" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.085750,1.717130,503,0 0 0 1 1 1 0 0 0 0 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="169.2.209.2" dst_ip="202.92.224.149" src_port="80" dst_port="65304"/>
            <filter src_ip="187.152.202.2" dst_ip="202.92.224.149" src_port="80" dst_port="60676"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.222200,1.742930,503,1 1 0 1 1 1 0 0 0 0 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="169.27.37.196" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.122800,1.715330,999,1 0 0 1 1 1 0 0 0 0 1 1,mptpla">
        <slice>
            <filter src_ip="194.162.73.190" dst_ip="215.129.60.175"/>
            <filter dst_ip="215.129.60.175" src_port="21001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.085750,1.717130,999,0 0 0 1 1 1 0 0 0 0 1 1,ptmpla">
        <slice>
            <filter src_ip="215.129.60.175" dst_ip="194.162.73.190"/>
            <filter src_ip="215.129.60.175" dst_port="21001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.329920,1.863940,010,1 1 1 1 1 1 0 0 0 0 1 0,ntscSYNt">
        <slice>
            <filter src_ip="2.73.69.52" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.523830,1.336440,999,0 0 0 1 1 0 0 0 0 0 1 1,mptpla">
        <slice>
            <filter src_ip="147.84.74.237" dst_ip="215.129.57.61" src_port="50653" dst_port="80"/>
            <filter src_ip="40.44.49.161" dst_ip="215.129.57.61" src_port="80" dst_port="1024"/>
            <filter src_ip="202.168.2.9" dst_ip="215.129.57.61" src_port="873" dst_port="58610"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.253030,1.739040,503,1 1 1 1 1 0 1 1 0 0 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="214.46.76.108" dst_port="53"/>
            <filter src_ip="214.46.76.108" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.523830,1.336440,503,0 0 0 1 1 0 0 0 0 0 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="187.152.65.3" dst_ip="202.92.224.220" src_port="80" dst_port="43268"/>
            <filter src_ip="169.2.209.81" dst_ip="202.92.224.220" src_port="80" dst_port="38065"/>
            <filter src_ip="169.2.232.231" dst_ip="202.92.224.220" src_port="80" dst_port="40166"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.410880,1.242710,503,1 1 0 1 1 0 0 0 0 0 1 0,mptmp">
        <slice>
            <filter src_ip="214.33.2.156" dst_port="80"/>
            <filter src_ip="215.129.58.76" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.523830,1.336440,503,0 0 0 1 1 0 0 0 0 0 1 1,mptmp">
        <slice>
            <filter src_ip="98.230.18.133" src_port="80"/>
            <filter dst_ip="214.33.131.48" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.681030,2.969550,503,1 1 0 1 1 1 1 1 1 0 1 1,alphflHTTP">
        <slice>
            <filter src_ip="144.213.162.161" dst_ip="215.129.50.232" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.653890,1.520090,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.158.29.146" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1352610135"/>
        <to usec="0" sec="1352610901"/>
    </anomaly>
    <anomaly type="anomalous" value="2.624000,1.995110,010,1 1 1 1 1 1 1 0 0 0 1 1,ntscSYNt">
        <slice>
            <filter src_ip="14.162.108.211" src_port="64836" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.065940,2.673650,020,1 1 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="77.158.29.146"/>
        </slice>
        <from usec="0" sec="1352610135"/>
        <to usec="0" sec="1352610899"/>
    </anomaly>
    <anomaly type="anomalous" value="1.968180,1.687590,999,1 1 1 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="24.74.34.63" src_port="5072" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1352610585"/>
        <to usec="0" sec="1352610901"/>
    </anomaly>
    <anomaly type="anomalous" value="3.049230,2.655920,999,0 0 0 1 0 0 1 1 1 0 1 0,mptmp">
        <slice>
            <filter src_ip="214.46.77.171" src_port="53"/>
            <filter src_ip="214.46.77.144" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.593180,1.455310,999,0 0 0 1 1 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="130.30.102.29" src_port="53"/>
            <filter dst_ip="130.30.103.107" src_port="53"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610826"/>
    </anomaly>
    <anomaly type="anomalous" value="1.593180,1.455310,020,0 0 0 1 1 0 1 1 0 0 0 0,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="40.44.49.161"/>
            <filter dst_ip="40.44.49.161"/>
            <filter dst_ip="40.44.49.161" src_port="3072" dst_port="80"/>
            <filter dst_ip="40.44.49.161" src_port="1024" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610826"/>
    </anomaly>
    <anomaly type="anomalous" value="3.386960,2.835950,503,1 1 1 1 1 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="0.153.160.45" dst_ip="215.129.56.103" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610899"/>
    </anomaly>
    <anomaly type="anomalous" value="2.085750,1.717130,503,0 0 0 1 1 1 0 0 0 0 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="169.2.234.143" dst_ip="38.196.210.145" src_port="80"/>
            <filter src_ip="187.152.137.158" dst_ip="38.196.210.145" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.085750,1.717130,503,0 0 0 1 1 1 0 0 0 0 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="130.30.213.70" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.141450,1.608660,503,1 1 0 1 1 0 1 1 0 0 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="215.129.57.56" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.999500,1.580680,503,0 0 0 1 1 0 1 1 0 0 1 1,mptmp">
        <slice>
            <filter dst_ip="214.46.103.14" src_port="80"/>
            <filter dst_ip="214.46.103.14" src_port="53"/>
            <filter dst_ip="215.129.58.76" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.288460,1.288160,503,0 0 0 0 0 0 0 0 0 0 1 1,alphflHTTP">
        <slice>
            <filter src_ip="214.33.131.48" dst_ip="203.18.42.89" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.085750,1.717130,503,0 0 0 1 1 1 0 0 0 0 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="172.63.160.18" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.085750,1.717130,503,0 0 0 1 1 1 0 0 0 0 1 1,alphflHTTP">
        <slice>
            <filter src_ip="169.2.71.252" dst_ip="38.196.210.144" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.288460,1.288160,503,0 0 0 0 0 0 0 0 0 0 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="5.141.104.62" dst_ip="130.30.157.72" src_port="80" dst_port="49356"/>
            <filter src_ip="5.141.104.62" dst_ip="130.30.157.72" src_port="80" dst_port="49343"/>
            <filter src_ip="5.141.104.62" dst_ip="130.30.198.113" src_port="80" dst_port="49578"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.085750,1.717130,503,0 0 0 1 1 1 0 0 0 0 1 1,mptmp">
        <slice>
            <filter src_ip="35.120.224.42" src_port="80"/>
            <filter src_ip="35.120.224.42" src_port="443"/>
            <filter dst_ip="130.30.158.210" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.288460,1.288160,503,0 0 0 0 0 0 0 0 0 0 1 1,point_to_point">
        <slice>
            <filter src_ip="172.63.36.165" dst_ip="38.196.210.62" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.288460,1.288160,503,0 0 0 0 0 0 0 0 0 0 1 1,alphflHTTP">
        <slice>
            <filter src_ip="187.152.192.40" dst_ip="38.196.210.36" src_port="80" dst_port="35941"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.288460,1.288160,999,0 0 0 0 0 0 0 0 0 0 1 1,ptmp">
        <slice>
            <filter src_ip="130.30.26.181" src_port="63163" dst_port="17788"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.288460,1.288160,504,0 0 0 0 0 0 0 0 0 0 1 1,ptmpla">
        <slice>
            <filter src_ip="214.33.136.65" dst_port="443"/>
            <filter src_ip="214.33.136.65" dst_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.288460,1.288160,503,0 0 0 0 0 0 0 0 0 0 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="215.129.53.57" dst_ip="38.196.217.11" src_port="80"/>
            <filter src_ip="215.129.53.57" dst_ip="202.92.224.84" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.288460,1.288160,999,0 0 0 0 0 0 0 0 0 0 1 1,ptmpla">
        <slice>
            <filter src_ip="194.73.155.188" dst_ip="214.33.138.64" src_port="4365" dst_port="34927"/>
            <filter src_ip="194.73.155.188" dst_ip="128.70.255.30" src_port="4365" dst_port="33261"/>
            <filter src_ip="194.73.155.188" dst_ip="128.70.255.18" src_port="80" dst_port="52533"/>
            <filter src_ip="194.73.155.188" dst_ip="130.30.16.208" src_port="4365" dst_port="62012"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.288460,1.288160,503,0 0 0 0 0 0 0 0 0 0 1 1,salphfl">
        <slice>
            <filter src_ip="35.12.127.49" dst_ip="128.70.219.245" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.523830,1.336440,999,0 0 0 1 1 0 0 0 0 0 1 1,mptp">
        <slice>
            <filter dst_ip="214.46.103.78" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.288460,1.288160,503,0 0 0 0 0 0 0 0 0 0 1 1,alphflHTTP">
        <slice>
            <filter src_ip="35.162.128.103" dst_ip="214.33.2.156" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.288460,1.288160,503,0 0 0 0 0 0 0 0 0 0 1 1,alphflHTTP">
        <slice>
            <filter src_ip="54.45.142.166" dst_ip="130.30.157.178" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.266990,1.266680,503,0 0 0 1 0 0 0 0 0 0 1 1,alphflHTTP">
        <slice>
            <filter src_ip="148.163.5.209" dst_ip="130.30.157.164" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.309430,1.796820,010,1 1 1 0 0 0 1 1 0 0 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="40.44.49.161" src_port="80" dst_port="1024"/>
            <filter src_ip="40.44.49.161" src_port="80" dst_port="3072"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.288460,1.288160,503,0 0 0 0 0 0 0 0 0 0 1 1,malphfl">
        <slice>
            <filter src_ip="169.2.51.110" dst_ip="202.92.224.77" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.085750,1.717130,503,0 0 0 1 1 1 0 0 0 0 1 1,mptmp">
        <slice>
            <filter src_ip="130.30.157.40" dst_port="443"/>
            <filter src_ip="172.63.160.17" src_port="80"/>
            <filter dst_ip="216.254.90.225" dst_port="443"/>
            <filter dst_ip="216.254.90.225" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="196.250.73.212" dst_ip="215.129.62.5" src_port="63780" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610637"/>
        <to usec="0" sec="1352610643"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,504,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="130.30.26.1" dst_ip="98.214.98.78" src_port="50180" dst_port="443"/>
        </slice>
        <from usec="0" sec="1352610531"/>
        <to usec="0" sec="1352610535"/>
    </anomaly>
    <anomaly type="suspicious" value="0.856327,1.145920,504,1 1 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="130.30.82.163" dst_ip="216.254.89.193" src_port="56871" dst_port="443"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610561"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="173.166.132.224" dst_ip="198.139.4.34" src_port="62367" dst_port="443"/>
        </slice>
        <from usec="0" sec="1352610565"/>
        <to usec="0" sec="1352610574"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="130.30.158.210" dst_ip="136.25.43.33" src_port="55860" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610726"/>
        <to usec="0" sec="1352610731"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="130.30.27.114" dst_ip="222.25.97.18" src_port="53516" dst_port="80"/>
            <filter src_ip="130.30.27.114" dst_ip="222.25.97.18" src_port="53515" dst_port="80"/>
            <filter src_ip="130.30.27.114" dst_ip="222.25.97.18" src_port="53375" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610193"/>
        <to usec="0" sec="1352610897"/>
    </anomaly>
    <anomaly type="suspicious" value="0.856327,1.145920,504,1 1 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="130.30.156.89" dst_port="443"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610834"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="12.36.21.147" dst_ip="130.30.157.213" src_port="61544" dst_port="15935"/>
        </slice>
        <from usec="0" sec="1352610517"/>
        <to usec="0" sec="1352610521"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="130.30.184.147" dst_ip="208.223.25.77" src_port="59143" dst_port="443"/>
            <filter src_ip="130.30.184.147" dst_ip="208.223.25.77" src_port="59142" dst_port="443"/>
            <filter src_ip="130.30.184.147" dst_ip="208.223.25.77" src_port="59139" dst_port="443"/>
        </slice>
        <from usec="0" sec="1352610619"/>
        <to usec="0" sec="1352610622"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="54.19.118.218" dst_ip="215.129.52.202" src_port="49863" dst_port="61963"/>
        </slice>
        <from usec="0" sec="1352610182"/>
        <to usec="0" sec="1352610885"/>
    </anomaly>
    <anomaly type="suspicious" value="0.856327,1.145920,503,1 1 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="169.193.87.254" dst_ip="100.88.208.36" src_port="62101" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610396"/>
        <to usec="0" sec="1352610402"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="130.30.157.1" dst_ip="154.116.86.30" src_port="64271" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610148"/>
        <to usec="0" sec="1352610847"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="130.30.156.54" dst_ip="41.136.40.148" src_port="57261" dst_port="80"/>
            <filter src_ip="130.30.156.54" dst_ip="36.71.176.156" src_port="62363" dst_port="80"/>
            <filter src_ip="130.30.156.54" dst_ip="53.5.174.88" src_port="57228" dst_port="80"/>
            <filter src_ip="130.30.156.54" dst_ip="51.180.38.74" src_port="59760" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610145"/>
        <to usec="0" sec="1352610738"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.129.57.61" dst_ip="202.168.2.9" src_port="58610" dst_port="873"/>
        </slice>
        <from usec="0" sec="1352610145"/>
        <to usec="0" sec="1352610858"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795133,1.172250,999,0 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.129.58.20" dst_ip="140.12.161.79" src_port="3389" proto="tcp"/>
        </slice>
        <from usec="0" sec="1352610211"/>
        <to usec="0" sec="1352610849"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="169.27.4.21" dst_ip="98.214.32.43" src_port="51519" dst_port="443"/>
        </slice>
        <from usec="0" sec="1352610430"/>
        <to usec="0" sec="1352610485"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="130.30.158.176" dst_ip="139.80.84.77" src_port="64303" dst_port="1935"/>
        </slice>
        <from usec="0" sec="1352610175"/>
        <to usec="0" sec="1352610884"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.129.52.202" dst_ip="54.19.118.218" src_port="61963" dst_port="49863"/>
        </slice>
        <from usec="0" sec="1352610342"/>
        <to usec="0" sec="1352610870"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="130.30.156.15" dst_ip="139.80.84.99" src_port="56218" dst_port="1935"/>
        </slice>
        <from usec="0" sec="1352610203"/>
        <to usec="0" sec="1352610755"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="130.30.157.38" dst_ip="22.24.135.203" src_port="61905" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610342"/>
        <to usec="0" sec="1352610754"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="130.30.158.175" dst_ip="35.120.252.174" dst_port="443"/>
        </slice>
        <from usec="0" sec="1352610715"/>
        <to usec="0" sec="1352610833"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="144.49.164.38" dst_ip="169.4.121.49" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610534"/>
        <to usec="0" sec="1352610538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.27.4.226" dst_ip="202.243.78.145" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610219"/>
        <to usec="0" sec="1352610864"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.193.136.144" dst_ip="37.35.229.160" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610148"/>
        <to usec="0" sec="1352610879"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="130.30.26.216" dst_ip="144.2.14.28" src_port="50069" dst_port="443"/>
        </slice>
        <from usec="0" sec="1352610239"/>
        <to usec="0" sec="1352610771"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="194.44.143.207" dst_ip="130.30.68.218" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610299"/>
        <to usec="0" sec="1352610303"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="130.30.216.106" dst_ip="187.209.208.29" src_port="62564" dst_port="443"/>
        </slice>
        <from usec="0" sec="1352610632"/>
        <to usec="0" sec="1352610637"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="130.30.157.217" dst_ip="139.81.167.10" src_port="58786" dst_port="1935"/>
        </slice>
        <from usec="0" sec="1352610158"/>
        <to usec="0" sec="1352610745"/>
    </anomaly>
    <anomaly type="suspicious" value="1.152680,1.190640,503,1 1 0 0 0 0 0 0 0 0 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="169.27.5.194" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="169.27.4.200" dst_ip="216.200.40.3" src_port="50025" dst_port="1935"/>
        </slice>
        <from usec="0" sec="1352610195"/>
        <to usec="0" sec="1352610885"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795133,1.172250,503,0 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="130.30.156.139" dst_ip="205.164.82.21" src_port="52280" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1352610772"/>
        <to usec="0" sec="1352610779"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="130.30.157.170" dst_ip="82.55.101.17" src_port="50561" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610588"/>
        <to usec="0" sec="1352610831"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795133,1.172250,999,0 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="130.30.156.204" dst_ip="216.200.44.216" src_port="59271" dst_port="1935" proto="tcp"/>
        </slice>
        <from usec="0" sec="1352610158"/>
        <to usec="0" sec="1352610756"/>
    </anomaly>
    <anomaly type="suspicious" value="0.856327,1.145920,504,1 1 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="169.27.4.157" dst_ip="216.229.242.194" dst_port="443"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610443"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,503,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="196.166.48.133" dst_ip="169.27.167.0" src_port="58289" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610152"/>
        <to usec="0" sec="1352610271"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="169.27.5.42" dst_port="443"/>
        </slice>
        <from usec="0" sec="1352610419"/>
        <to usec="0" sec="1352610483"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.193.136.160" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610203"/>
        <to usec="0" sec="1352610794"/>
    </anomaly>
    <anomaly type="suspicious" value="0.795133,1.172250,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="152.234.216.111" dst_ip="152.234.216.111" proto="icmp"/>
        </slice>
        <from usec="0" sec="1352610428"/>
        <to usec="0" sec="1352610433"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="214.46.77.54" src_port="60832"/>
        </slice>
        <from usec="0" sec="1352610161"/>
        <to usec="0" sec="1352610632"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="104.237.4.165" dst_port="445"/>
        </slice>
        <from usec="0" sec="1352610013"/>
        <to usec="0" sec="1352610018"/>
    </anomaly>
    <anomaly type="suspicious" value="0.887786,1.169620,504,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="130.30.157.133" dst_port="443"/>
        </slice>
        <from usec="0" sec="1352610298"/>
        <to usec="0" sec="1352610304"/>
    </anomaly>
    <anomaly type="suspicious" value="1.268860,1.430460,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="77.158.29.146" dst_ip="77.158.29.146" proto="icmp"/>
        </slice>
        <from usec="0" sec="1352610153"/>
        <to usec="0" sec="1352610899"/>
    </anomaly>
    <anomaly type="suspicious" value="1.268860,1.430460,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="152.234.216.111" dst_ip="152.234.216.111" proto="icmp"/>
        </slice>
        <from usec="0" sec="1352610428"/>
        <to usec="0" sec="1352610433"/>
    </anomaly>
    <anomaly type="suspicious" value="1.009070,1.182900,999,1 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="130.30.158.173" src_port="11485"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.247310,1.254770,999,1 0 0 1 1 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="215.129.52.129"/>
            <filter src_ip="215.129.56.104"/>
            <filter src_ip="215.129.51.16"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610884"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957687,1.208430,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610558"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957687,1.208430,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610828"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928599,1.185510,502,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="215.129.50.240" dst_port="22"/>
            <filter dst_ip="215.129.50.240"/>
        </slice>
        <from usec="0" sec="1352610002"/>
        <to usec="0" sec="1352610468"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928599,1.185510,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="169.27.112.143" dst_port="53"/>
        </slice>
        <from usec="0" sec="1352610017"/>
        <to usec="0" sec="1352610467"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928599,1.185510,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="194.11.48.160" dst_ip="215.129.50.5" dst_port="80"/>
            <filter src_ip="194.4.56.193" dst_ip="215.129.50.5" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610002"/>
        <to usec="0" sec="1352610552"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928599,1.185510,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="169.2.132.2" src_port="25"/>
        </slice>
        <from usec="0" sec="1352610097"/>
        <to usec="0" sec="1352610558"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928599,1.185510,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="215.138.222.52" dst_port="135"/>
            <filter src_ip="215.138.222.52" dst_port="445"/>
        </slice>
        <from usec="0" sec="1352610001"/>
        <to usec="0" sec="1352610716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928599,1.185510,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="154.117.39.105" dst_ip="215.129.57.19" src_port="443"/>
            <filter src_ip="154.117.39.105" dst_ip="130.30.157.184" src_port="80"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610816"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928599,1.185510,020,0 0 0 1 1 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="169.27.190.116"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610828"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928599,1.185510,999,0 0 0 1 1 0 0 0 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="221.195.64.241" dst_ip="130.30.156.150"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610826"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928599,1.185510,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.2.1.26" dst_ip="38.196.210.135" src_port="80"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610820"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928599,1.185510,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="215.129.53.34" src_port="993"/>
            <filter src_ip="215.129.53.34" dst_ip="43.121.77.114" src_port="143"/>
            <filter src_ip="215.129.53.34"/>
        </slice>
        <from usec="0" sec="1352610006"/>
        <to usec="0" sec="1352610828"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928599,1.185510,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="173.166.218.170" dst_ip="136.217.98.220" src_port="4405"/>
        </slice>
        <from usec="0" sec="1352610235"/>
        <to usec="0" sec="1352610823"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928599,1.185510,503,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="173.166.255.77" dst_ip="208.44.140.144" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610649"/>
        <to usec="0" sec="1352610800"/>
    </anomaly>
    <anomaly type="suspicious" value="1.492870,1.562440,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610198"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="169.229.136.225"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="169.27.190.116"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="221.169.101.242" dst_port="53"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,503,0 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="215.205.58.163"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="214.33.148.16" src_port="53"/>
            <filter src_ip="195.182.231.178" dst_ip="214.33.148.16" dst_port="53"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="128.70.165.88"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="130.30.68.216" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="130.30.68.218"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="215.129.51.85" src_port="53"/>
            <filter dst_ip="215.129.51.85" dst_port="53"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="215.129.51.80" dst_port="53"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="215.129.51.82" dst_port="53"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="130.30.134.228"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="215.129.53.56" src_port="53"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,503,0 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="22.178.238.178"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="214.46.117.56" dst_port="53"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.826470,1.182820,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="169.27.112.142" src_port="53"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610828"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,011,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="22.166.39.34" src_port="22" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610180"/>
        <to usec="0" sec="1352610226"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="217.1.182.125" src_port="80" dst_port="1234"/>
        </slice>
        <from usec="0" sec="1352610135"/>
        <to usec="0" sec="1352610631"/>
    </anomaly>
    <anomaly type="suspicious" value="0.826470,1.182820,999,0 0 0 1 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="214.183.5.193" src_port="53"/>
        </slice>
        <from usec="0" sec="1352610003"/>
        <to usec="0" sec="1352610721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,010,0 0 0 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_port="4935" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1352610585"/>
        <to usec="0" sec="1352610631"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,011,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="22.166.39.34" src_port="22" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610675"/>
        <to usec="0" sec="1352610721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="39.209.21.165"/>
        </slice>
        <from usec="0" sec="1352610855"/>
        <to usec="0" sec="1352610901"/>
    </anomaly>
    <anomaly type="suspicious" value="0.859024,1.205790,011,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="22.166.39.34" src_port="22" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610855"/>
        <to usec="0" sec="1352610901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.369780,1.411100,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.27.96.7" dst_ip="215.205.58.163" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610135"/>
        <to usec="0" sec="1352610181"/>
    </anomaly>
    <anomaly type="suspicious" value="1.369780,1.411100,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="221.128.108.61" dst_ip="215.129.51.66" dst_port="53"/>
            <filter src_ip="221.128.108.38" dst_ip="215.129.51.66" dst_port="53"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.369780,1.411100,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="221.169.101.242" dst_port="53"/>
        </slice>
        <from usec="0" sec="1352610675"/>
        <to usec="0" sec="1352610721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.349600,1.391530,999,0 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="196.97.73.14" dst_ip="169.229.136.225"/>
            <filter src_ip="196.97.73.14" src_port="53"/>
            <filter dst_ip="215.129.51.85" src_port="53"/>
            <filter dst_ip="215.129.51.85" dst_port="53"/>
            <filter dst_ip="169.229.136.225" src_port="53"/>
        </slice>
        <from usec="0" sec="1352610017"/>
        <to usec="0" sec="1352610828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.369780,1.411100,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="215.129.51.80" dst_port="53"/>
        </slice>
        <from usec="0" sec="1352610135"/>
        <to usec="0" sec="1352610721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.369780,1.411100,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="215.129.51.82" dst_port="53"/>
        </slice>
        <from usec="0" sec="1352610675"/>
        <to usec="0" sec="1352610721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.369780,1.411100,020,0 0 0 0 0 0 1 1 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="215.129.51.16"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.157030,1.347600,999,0 0 0 0 0 0 0 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="215.129.57.39"/>
        </slice>
        <from usec="0" sec="1352610675"/>
        <to usec="0" sec="1352610721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.369780,1.411100,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="215.129.57.32" dst_port="53"/>
        </slice>
        <from usec="0" sec="1352610675"/>
        <to usec="0" sec="1352610721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.349600,1.391530,504,0 0 0 1 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="98.230.24.99" dst_ip="130.30.158.160" src_port="443"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610808"/>
    </anomaly>
    <anomaly type="suspicious" value="1.369780,1.411100,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="215.129.58.99" dst_ip="196.97.73.14" dst_port="53"/>
            <filter src_ip="169.229.136.225" dst_ip="196.97.73.14" dst_port="53"/>
            <filter src_ip="215.129.51.85" dst_ip="196.97.73.14" dst_port="53"/>
        </slice>
        <from usec="0" sec="1352610675"/>
        <to usec="0" sec="1352610721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.369780,1.411100,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="215.129.54.234" dst_port="53"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.369780,1.411100,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.27.55.158" dst_ip="22.178.238.178" dst_port="80"/>
        </slice>
        <from usec="0" sec="1352610675"/>
        <to usec="0" sec="1352610721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.369780,1.411100,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="214.33.148.164" dst_port="53"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.369780,1.411100,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="214.46.117.56" dst_port="53"/>
        </slice>
        <from usec="0" sec="1352610675"/>
        <to usec="0" sec="1352610721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.369780,1.411100,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="215.129.52.25" dst_port="51413"/>
        </slice>
        <from usec="0" sec="1352610000"/>
        <to usec="0" sec="1352610721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.917561,1.125750,999,1 0 0 1 0 0 0 0 0 0 1 0,mptmp">
        <slice>
            <filter src_ip="147.63.186.33" src_port="80"/>
            <filter src_ip="5.141.104.51" dst_ip="173.166.132.210"/>
            <filter dst_ip="173.166.132.210" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.860731,1.152540,503,0 0 0 0 0 0 0 0 0 0 1 0,alphflHTTP">
        <slice>
            <filter src_ip="169.2.238.23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.860731,1.152540,503,0 0 0 0 0 0 0 0 0 0 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.2.208.95"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.860731,1.152540,503,0 0 0 0 0 0 0 0 0 0 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="187.152.196.27"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.860731,1.152540,503,0 0 0 0 0 0 0 0 0 0 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="130.30.175.66"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.860731,1.152540,503,0 0 0 0 0 0 0 0 0 0 1 0,alphflHTTP">
        <slice>
            <filter src_ip="196.5.40.249"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.860731,1.152540,999,0 0 0 0 0 0 0 0 0 0 1 0,alphfl">
        <slice>
            <filter src_ip="197.146.1.124"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.860731,1.152540,503,0 0 0 0 0 0 0 0 0 0 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="169.4.196.155"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828245,1.128490,503,0 0 0 1 0 0 0 0 0 0 1 0,mptmp">
        <slice>
            <filter src_ip="216.254.90.229" src_port="80"/>
            <filter dst_ip="130.30.26.103" src_port="80"/>
            <filter src_ip="79.89.98.132" dst_ip="130.30.26.103" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.130670,1.226190,999,0 0 0 0 0 0 1 0 0 0 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="130.30.26.181" dst_port="63163"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.860731,1.152540,504,0 0 0 0 0 0 0 0 0 0 1 0,alphfl">
        <slice>
            <filter dst_ip="140.13.6.58"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.860731,1.152540,503,0 0 0 0 0 0 0 0 0 0 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="38.196.210.177"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828245,1.128490,503,0 0 0 1 0 0 0 0 0 0 1 0,alphflHTTP">
        <slice>
            <filter src_ip="187.152.80.172" dst_ip="44.136.150.207" src_port="80" dst_port="57045"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
