<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.348230,1.175270,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="151.122.215.50" dst_ip="40.177.104.40" src_port="49689" dst_port="80"/>
            <filter src_ip="151.122.215.50" dst_ip="132.17.101.255" src_port="62096" dst_port="80"/>
            <filter src_ip="151.122.215.50" dst_ip="135.224.181.14" src_port="53121" dst_port="80"/>
            <filter src_ip="151.122.215.50" dst_ip="59.7.217.249" src_port="62108" dst_port="10002"/>
        </slice>
        <from usec="0" sec="1359781693"/>
        <to usec="0" sec="1359781698"/>
    </anomaly>
    <anomaly type="anomalous" value="1.386950,1.140400,999,1 1 1 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="8.112.4.138" dst_ip="206.15.144.51"/>
            <filter src_ip="81.39.27.102" dst_ip="206.15.144.51"/>
            <filter dst_ip="206.15.144.51" dst_port="53"/>
            <filter src_ip="8.112.4.138" dst_ip="206.15.153.56" dst_port="53"/>
            <filter src_ip="81.39.27.102" dst_ip="206.15.153.56" dst_port="53"/>
        </slice>
        <from usec="0" sec="1359781208"/>
        <to usec="0" sec="1359782054"/>
    </anomaly>
    <anomaly type="anomalous" value="1.476100,1.198620,999,1 1 1 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="151.122.66.55" src_port="11348"/>
            <filter src_ip="151.122.66.55" dst_port="80"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359782029"/>
    </anomaly>
    <anomaly type="anomalous" value="1.348230,1.175270,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="218.83.128.158" src_port="1433" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1359781980"/>
        <to usec="0" sec="1359781984"/>
    </anomaly>
    <anomaly type="anomalous" value="1.348230,1.175270,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="143.14.194.226" src_port="21445" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1359782071"/>
        <to usec="0" sec="1359782078"/>
    </anomaly>
    <anomaly type="anomalous" value="2.124110,1.561350,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="207.142.169.184" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1359781238"/>
        <to usec="0" sec="1359781843"/>
    </anomaly>
    <anomaly type="anomalous" value="1.790450,1.364740,010,1 1 1 1 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="218.83.128.158" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1359781966"/>
        <to usec="0" sec="1359782012"/>
    </anomaly>
    <anomaly type="anomalous" value="2.124110,1.561350,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="88.152.160.198" src_port="6000" dst_port="6666"/>
        </slice>
        <from usec="0" sec="1359781246"/>
        <to usec="0" sec="1359781292"/>
    </anomaly>
    <anomaly type="anomalous" value="1.308510,1.130590,010,1 1 1 1 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="88.90.186.67" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1359781806"/>
        <to usec="0" sec="1359781937"/>
    </anomaly>
    <anomaly type="anomalous" value="2.124110,1.561350,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="88.152.186.122" src_port="6000" dst_port="6675"/>
        </slice>
        <from usec="0" sec="1359781966"/>
        <to usec="0" sec="1359782012"/>
    </anomaly>
    <anomaly type="anomalous" value="1.424490,1.184700,011,1 1 1 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="2.111.145.57" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781246"/>
        <to usec="0" sec="1359781292"/>
    </anomaly>
    <anomaly type="anomalous" value="1.348230,1.175270,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="16.212.77.143" dst_port="23"/>
        </slice>
        <from usec="0" sec="1359781208"/>
        <to usec="0" sec="1359781210"/>
    </anomaly>
    <anomaly type="anomalous" value="1.348230,1.175270,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="212.219.136.221" dst_port="23"/>
        </slice>
        <from usec="0" sec="1359781692"/>
        <to usec="0" sec="1359781694"/>
    </anomaly>
    <anomaly type="anomalous" value="1.308510,1.130590,011,1 1 1 1 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="88.152.160.198" src_port="6666" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359781489"/>
    </anomaly>
    <anomaly type="anomalous" value="1.348230,1.175270,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="88.152.186.122" src_port="6675" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1359781977"/>
        <to usec="0" sec="1359781980"/>
    </anomaly>
    <anomaly type="anomalous" value="1.401150,1.189920,002,1 0 0 1 1 1 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="93.72.17.101" dst_ip="189.136.52.105" dst_port="137"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359782029"/>
    </anomaly>
    <anomaly type="anomalous" value="1.199830,1.156800,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.122.187.196" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781245"/>
        <to usec="0" sec="1359782029"/>
    </anomaly>
    <anomaly type="anomalous" value="1.199830,1.156800,503,0 0 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="206.15.151.25" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359782029"/>
    </anomaly>
    <anomaly type="anomalous" value="1.199830,1.156800,503,0 0 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="8.138.65.149" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359781399"/>
    </anomaly>
    <anomaly type="anomalous" value="1.737330,1.361450,503,1 1 1 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="211.20.146.199" src_port="80"/>
            <filter dst_ip="151.122.83.60" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359781938"/>
    </anomaly>
    <anomaly type="anomalous" value="1.199830,1.156800,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="207.16.17.100" dst_ip="43.221.29.150" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781510"/>
        <to usec="0" sec="1359781569"/>
    </anomaly>
    <anomaly type="anomalous" value="1.199830,1.156800,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.122.215.50" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359781759"/>
    </anomaly>
    <anomaly type="anomalous" value="1.199830,1.156800,503,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="206.0.252.103" src_port="80"/>
            <filter src_ip="194.74.28.137" src_port="80"/>
            <filter dst_ip="207.24.173.175" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359782010"/>
    </anomaly>
    <anomaly type="anomalous" value="1.199830,1.156800,504,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="104.81.9.164" src_port="443"/>
            <filter dst_ip="151.122.184.219" src_port="443"/>
            <filter src_ip="104.81.9.164" dst_ip="151.122.184.219" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781204"/>
        <to usec="0" sec="1359781999"/>
    </anomaly>
    <anomaly type="anomalous" value="1.199830,1.156800,503,0 0 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="1.161.154.141" src_port="80"/>
            <filter dst_ip="151.122.213.233" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781403"/>
        <to usec="0" sec="1359781841"/>
    </anomaly>
    <anomaly type="anomalous" value="1.199830,1.156800,503,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="207.24.20.9" src_port="80"/>
            <filter dst_ip="151.122.186.127" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781207"/>
        <to usec="0" sec="1359781937"/>
    </anomaly>
    <anomaly type="anomalous" value="1.934470,1.425420,010,1 1 1 1 1 1 1 1 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="206.15.156.86" dst_ip="34.166.203.117" src_port="80"/>
            <filter src_ip="206.15.156.86" dst_ip="131.20.215.53" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359782095"/>
    </anomaly>
    <anomaly type="anomalous" value="1.199830,1.156800,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="1.161.154.59" dst_ip="207.24.174.231" src_port="80"/>
            <filter src_ip="1.161.154.75" dst_ip="207.24.174.231" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359781828"/>
    </anomaly>
    <anomaly type="anomalous" value="1.470870,1.231450,503,0 0 0 1 1 1 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="207.16.17.59" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359782028"/>
    </anomaly>
    <anomaly type="anomalous" value="1.392550,1.184320,010,1 0 0 1 0 0 1 1 1 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="34.166.203.117" dst_ip="206.15.156.86" dst_port="80"/>
            <filter src_ip="131.20.215.53" dst_ip="206.15.156.86" dst_port="80"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359782040"/>
    </anomaly>
    <anomaly type="anomalous" value="1.316260,1.204230,011,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="27.218.34.241" src_port="80" dst_port="1234"/>
            <filter src_ip="27.218.35.18" src_port="80" dst_port="1234"/>
        </slice>
        <from usec="0" sec="1359781246"/>
        <to usec="0" sec="1359781292"/>
    </anomaly>
    <anomaly type="anomalous" value="1.275540,1.160670,010,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="196.90.171.132" dst_port="1024"/>
            <filter src_ip="211.15.16.40" src_port="80"/>
            <filter src_ip="211.15.16.40" dst_port="3072"/>
            <filter src_ip="211.15.16.40" dst_port="1024"/>
            <filter src_port="80" dst_port="1024"/>
            <filter src_ip="196.90.171.132" src_port="80" dst_port="3072"/>
        </slice>
        <from usec="0" sec="1359781225"/>
        <to usec="0" sec="1359782057"/>
    </anomaly>
    <anomaly type="anomalous" value="1.316260,1.204230,010,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="4935" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1359781246"/>
        <to usec="0" sec="1359781292"/>
    </anomaly>
    <anomaly type="anomalous" value="1.316260,1.204230,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="207.230.106.79" src_port="53" dst_port="1001"/>
        </slice>
        <from usec="0" sec="1359781246"/>
        <to usec="0" sec="1359782012"/>
    </anomaly>
    <anomaly type="anomalous" value="1.316260,1.204230,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="206.15.150.142" src_port="18240"/>
        </slice>
        <from usec="0" sec="1359781291"/>
        <to usec="0" sec="1359781337"/>
    </anomaly>
    <anomaly type="anomalous" value="1.316260,1.204230,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="206.15.150.128" dst_port="80"/>
        </slice>
        <from usec="0" sec="1359781291"/>
        <to usec="0" sec="1359782012"/>
    </anomaly>
    <anomaly type="anomalous" value="1.703740,1.270820,503,1 1 1 1 1 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="206.15.150.143"/>
            <filter src_ip="33.78.19.79" dst_ip="206.15.152.156" dst_port="80"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359782054"/>
    </anomaly>
    <anomaly type="anomalous" value="1.316260,1.204230,503,0 0 0 0 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="206.15.150.143" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781966"/>
        <to usec="0" sec="1359782012"/>
    </anomaly>
    <anomaly type="anomalous" value="1.316260,1.204230,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="206.15.150.143" dst_port="80"/>
        </slice>
        <from usec="0" sec="1359781966"/>
        <to usec="0" sec="1359782012"/>
    </anomaly>
    <anomaly type="anomalous" value="1.316260,1.204230,010,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="196.90.171.132" src_port="80" dst_port="1024"/>
            <filter src_ip="211.15.16.45" src_port="80" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1359781966"/>
        <to usec="0" sec="1359782057"/>
    </anomaly>
    <anomaly type="anomalous" value="1.316260,1.204230,011,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="27.218.35.18" src_port="80" dst_port="1234"/>
            <filter src_ip="27.218.34.241" src_port="80" dst_port="1234"/>
        </slice>
        <from usec="0" sec="1359781966"/>
        <to usec="0" sec="1359782057"/>
    </anomaly>
    <anomaly type="anomalous" value="1.316260,1.204230,010,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="4935" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1359781966"/>
        <to usec="0" sec="1359782012"/>
    </anomaly>
    <anomaly type="anomalous" value="1.233320,1.194950,999,0 0 0 0 0 0 0 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="184.147.80.208" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1359781246"/>
        <to usec="0" sec="1359781292"/>
    </anomaly>
    <anomaly type="anomalous" value="1.316260,1.204230,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="151.122.186.78" src_port="18751"/>
        </slice>
        <from usec="0" sec="1359781246"/>
        <to usec="0" sec="1359781427"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742432,0.959877,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="207.24.172.175" dst_ip="211.37.75.243" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1359781957"/>
        <to usec="0" sec="1359781962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742432,0.959877,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="207.16.42.44"/>
        </slice>
        <from usec="0" sec="1359781957"/>
        <to usec="0" sec="1359781962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742432,0.959877,503,1 0 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="189.7.207.166" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1359781957"/>
        <to usec="0" sec="1359781962"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742432,0.959877,502,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="140.200.92.17"/>
        </slice>
        <from usec="0" sec="1359781693"/>
        <to usec="0" sec="1359781698"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742432,0.959877,010,1 0 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="2.111.145.60" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1359781213"/>
        <to usec="0" sec="1359781216"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742432,0.959877,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="29.100.101.148" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1359782049"/>
        <to usec="0" sec="1359782052"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742432,0.959877,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="6.53.153.124" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1359781218"/>
        <to usec="0" sec="1359781222"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742432,0.959877,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.122.37.85" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1359782067"/>
        <to usec="0" sec="1359782072"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742432,0.959877,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="29.100.101.148" proto="icmp"/>
        </slice>
        <from usec="0" sec="1359782049"/>
        <to usec="0" sec="1359782052"/>
    </anomaly>
    <anomaly type="suspicious" value="1.011340,1.029400,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="151.122.184.192" dst_ip="140.203.8.83" dst_port="80"/>
        </slice>
        <from usec="0" sec="1359781208"/>
        <to usec="0" sec="1359781214"/>
    </anomaly>
    <anomaly type="suspicious" value="1.011340,1.029400,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="9.5.213.210" dst_ip="206.15.148.49" src_port="443"/>
        </slice>
        <from usec="0" sec="1359781499"/>
        <to usec="0" sec="1359781503"/>
    </anomaly>
    <anomaly type="suspicious" value="1.011340,1.029400,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="194.64.101.42" dst_ip="148.63.113.60" src_port="1935" dst_port="61566"/>
        </slice>
        <from usec="0" sec="1359781692"/>
        <to usec="0" sec="1359781695"/>
    </anomaly>
    <anomaly type="suspicious" value="1.011340,1.029400,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="24.199.18.64" src_port="15530" dst_port="22"/>
        </slice>
        <from usec="0" sec="1359781957"/>
        <to usec="0" sec="1359781962"/>
    </anomaly>
    <anomaly type="suspicious" value="1.011340,1.029400,010,1 1 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="59.212.222.5" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781892"/>
        <to usec="0" sec="1359781893"/>
    </anomaly>
    <anomaly type="suspicious" value="1.011340,1.029400,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="34.46.70.100" dst_port="8082"/>
            <filter src_ip="34.46.70.100" dst_port="3306"/>
            <filter src_ip="34.46.70.100" dst_port="1433"/>
            <filter src_ip="34.46.70.100" dst_port="445"/>
        </slice>
        <from usec="0" sec="1359781500"/>
        <to usec="0" sec="1359781506"/>
    </anomaly>
    <anomaly type="suspicious" value="1.011340,1.029400,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="34.46.71.188" dst_port="8082"/>
            <filter src_ip="34.46.71.188" dst_port="3306"/>
            <filter src_ip="34.46.71.188" dst_port="1433"/>
            <filter src_ip="34.46.71.188" dst_port="445"/>
        </slice>
        <from usec="0" sec="1359781498"/>
        <to usec="0" sec="1359781504"/>
    </anomaly>
    <anomaly type="suspicious" value="0.957737,0.978081,010,1 1 0 1 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.52.99.165" dst_port="6673"/>
            <filter src_ip="56.52.99.165" dst_port="3306"/>
            <filter src_ip="56.52.99.165" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1359781349"/>
        <to usec="0" sec="1359781363"/>
    </anomaly>
    <anomaly type="suspicious" value="1.011340,1.029400,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="34.46.70.156" dst_port="8082"/>
            <filter src_ip="34.46.70.156" dst_port="3306"/>
            <filter src_ip="34.46.70.156" dst_port="445"/>
            <filter src_ip="34.46.70.156" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1359781501"/>
        <to usec="0" sec="1359781506"/>
    </anomaly>
    <anomaly type="suspicious" value="1.011340,1.029400,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="34.46.71.42" dst_port="8082"/>
            <filter src_ip="34.46.71.42" dst_port="3306"/>
            <filter src_ip="34.46.71.42" dst_port="1433"/>
            <filter src_ip="34.46.71.42" dst_port="445"/>
        </slice>
        <from usec="0" sec="1359781499"/>
        <to usec="0" sec="1359781505"/>
    </anomaly>
    <anomaly type="suspicious" value="1.011340,1.029400,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="34.46.75.8" dst_port="1433"/>
            <filter src_ip="34.46.75.8" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1359781989"/>
        <to usec="0" sec="1359781994"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840053,1.012110,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359781399"/>
    </anomaly>
    <anomaly type="suspicious" value="0.774693,0.959865,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="206.15.152.133" dst_ip="131.82.92.93" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359781399"/>
    </anomaly>
    <anomaly type="suspicious" value="0.774693,0.959865,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="207.24.7.63" dst_port="53"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359781399"/>
    </anomaly>
    <anomaly type="suspicious" value="0.774693,0.959865,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="171.7.48.52" dst_ip="206.15.152.196" src_port="55100" dst_port="57336"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359781489"/>
    </anomaly>
    <anomaly type="suspicious" value="0.774693,0.959865,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="151.122.187.158" src_port="5274"/>
            <filter src_ip="151.122.187.158" src_port="9181"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359781579"/>
    </anomaly>
    <anomaly type="suspicious" value="0.774693,0.959865,502,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="207.24.168.188" dst_ip="197.66.128.139" src_port="22"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359781669"/>
    </anomaly>
    <anomaly type="suspicious" value="0.774693,0.959865,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="201.162.130.55" dst_ip="151.122.184.164" src_port="80" dst_port="50619"/>
        </slice>
        <from usec="0" sec="1359781415"/>
        <to usec="0" sec="1359781634"/>
    </anomaly>
    <anomaly type="suspicious" value="0.774693,0.959865,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="91.168.200.167" dst_ip="151.122.187.13" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781453"/>
        <to usec="0" sec="1359781522"/>
    </anomaly>
    <anomaly type="suspicious" value="0.774693,0.959865,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="89.21.172.64" dst_ip="184.147.56.230" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781628"/>
        <to usec="0" sec="1359781640"/>
    </anomaly>
    <anomaly type="suspicious" value="0.774693,0.959865,503,0 0 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="1.161.152.144" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781218"/>
        <to usec="0" sec="1359781849"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,504,0 0 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="104.81.2.122" dst_ip="151.122.67.56" src_port="443"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359781247"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,503,0 0 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="206.15.150.143" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781246"/>
        <to usec="0" sec="1359781292"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="206.15.150.143" dst_port="80"/>
        </slice>
        <from usec="0" sec="1359781246"/>
        <to usec="0" sec="1359781292"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,503,0 0 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="151.122.186.9" dst_port="80"/>
        </slice>
        <from usec="0" sec="1359781246"/>
        <to usec="0" sec="1359781292"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,504,0 0 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="104.81.2.122" dst_ip="151.122.67.56" src_port="443"/>
        </slice>
        <from usec="0" sec="1359781291"/>
        <to usec="0" sec="1359781337"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="206.15.152.156" dst_port="80"/>
        </slice>
        <from usec="0" sec="1359781246"/>
        <to usec="0" sec="1359781337"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="196.67.32.106" dst_port="53"/>
        </slice>
        <from usec="0" sec="1359781291"/>
        <to usec="0" sec="1359781337"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="206.15.150.142" dst_port="80"/>
        </slice>
        <from usec="0" sec="1359781291"/>
        <to usec="0" sec="1359781337"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="148.63.97.64" src_port="53"/>
        </slice>
        <from usec="0" sec="1359781291"/>
        <to usec="0" sec="1359781337"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="207.24.7.208" dst_port="53"/>
        </slice>
        <from usec="0" sec="1359781291"/>
        <to usec="0" sec="1359781337"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="207.24.7.213" dst_port="80"/>
        </slice>
        <from usec="0" sec="1359781291"/>
        <to usec="0" sec="1359781337"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="196.14.129.184"/>
        </slice>
        <from usec="0" sec="1359781381"/>
        <to usec="0" sec="1359781427"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="151.122.44.150"/>
        </slice>
        <from usec="0" sec="1359781291"/>
        <to usec="0" sec="1359781472"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.15.157.66"/>
        </slice>
        <from usec="0" sec="1359781426"/>
        <to usec="0" sec="1359781472"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="206.15.157.23"/>
        </slice>
        <from usec="0" sec="1359781426"/>
        <to usec="0" sec="1359781472"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,503,0 0 0 0 0 0 1 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="83.32.147.0"/>
        </slice>
        <from usec="0" sec="1359781426"/>
        <to usec="0" sec="1359781472"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.15.154.55" dst_port="53"/>
        </slice>
        <from usec="0" sec="1359781291"/>
        <to usec="0" sec="1359781472"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="207.24.7.213" dst_port="80"/>
        </slice>
        <from usec="0" sec="1359781516"/>
        <to usec="0" sec="1359781562"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="206.15.150.142" dst_port="80"/>
        </slice>
        <from usec="0" sec="1359781966"/>
        <to usec="0" sec="1359782012"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="59.212.222.5" src_port="80"/>
        </slice>
        <from usec="0" sec="1359781966"/>
        <to usec="0" sec="1359782012"/>
    </anomaly>
    <anomaly type="suspicious" value="0.671168,0.942427,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="206.15.152.156" dst_port="80"/>
        </slice>
        <from usec="0" sec="1359782011"/>
        <to usec="0" sec="1359782057"/>
    </anomaly>
    <anomaly type="suspicious" value="0.981266,1.021860,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="207.230.106.79" dst_ip="10.100.93.1" src_port="53"/>
        </slice>
        <from usec="0" sec="1359781426"/>
        <to usec="0" sec="1359781472"/>
    </anomaly>
    <anomaly type="suspicious" value="0.981266,1.021860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.15.157.69" dst_port="53"/>
        </slice>
        <from usec="0" sec="1359781291"/>
        <to usec="0" sec="1359781472"/>
    </anomaly>
    <anomaly type="suspicious" value="0.981266,1.021860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="206.15.157.64" dst_port="53"/>
        </slice>
        <from usec="0" sec="1359781291"/>
        <to usec="0" sec="1359781472"/>
    </anomaly>
    <anomaly type="suspicious" value="0.981266,1.021860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="151.122.186.78" dst_port="18751"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359781472"/>
    </anomaly>
    <anomaly type="suspicious" value="0.925928,0.970144,999,0 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="47.225.132.252" src_port="53"/>
            <filter dst_ip="151.122.6.9" src_port="53"/>
        </slice>
        <from usec="0" sec="1359781201"/>
        <to usec="0" sec="1359781849"/>
    </anomaly>
</admd:annotation>
