<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.112080,1.047780,503,1 1 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="144.206.53.44" dst_ip="209.146.100.197" dst_port="80"/>
        </slice>
        <from usec="0" sec="1362286853"/>
        <to usec="0" sec="1362287612"/>
    </anomaly>
    <anomaly type="anomalous" value="1.501040,1.299710,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="207.65.80.149" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1362287307"/>
        <to usec="0" sec="1362287309"/>
    </anomaly>
    <anomaly type="anomalous" value="1.501040,1.299710,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="204.238.41.161" dst_port="5000"/>
        </slice>
        <from usec="0" sec="1362286816"/>
        <to usec="0" sec="1362286822"/>
    </anomaly>
    <anomaly type="anomalous" value="1.123930,1.091050,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="89.56.67.47" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1362287318"/>
        <to usec="0" sec="1362287323"/>
    </anomaly>
    <anomaly type="anomalous" value="1.501040,1.299710,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="218.13.65.75" src_port="5000"/>
        </slice>
        <from usec="0" sec="1362287333"/>
        <to usec="0" sec="1362287348"/>
    </anomaly>
    <anomaly type="anomalous" value="1.807440,1.410150,503,1 1 1 1 1 1 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="209.146.105.197" dst_port="80"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287629"/>
    </anomaly>
    <anomaly type="anomalous" value="1.728950,1.405360,010,1 1 1 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="203.11.113.250" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1362287071"/>
        <to usec="0" sec="1362287117"/>
    </anomaly>
    <anomaly type="anomalous" value="1.492180,1.263610,010,1 1 1 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="125.225.58.84" src_port="25565"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287072"/>
    </anomaly>
    <anomaly type="anomalous" value="1.501040,1.299710,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="11.215.114.49" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1362286845"/>
        <to usec="0" sec="1362286859"/>
    </anomaly>
    <anomaly type="anomalous" value="1.116310,1.078980,999,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="93.26.55.56" dst_ip="209.146.105.227"/>
            <filter src_ip="203.152.161.72" dst_ip="209.146.105.227" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287265"/>
    </anomaly>
    <anomaly type="anomalous" value="1.254040,1.090300,503,1 0 0 1 1 1 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="209.146.100.197" dst_ip="144.206.53.44" src_port="80"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287611"/>
    </anomaly>
    <anomaly type="anomalous" value="1.807440,1.410150,020,1 1 1 1 1 1 1 0 0 0 0 0,hostout">
        <slice>
            <filter src_ip="209.38.71.182"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287539"/>
    </anomaly>
    <anomaly type="anomalous" value="2.203130,1.679060,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="27.175.27.252" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1362286918"/>
        <to usec="0" sec="1362287448"/>
    </anomaly>
    <anomaly type="anomalous" value="1.492180,1.263610,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="218.13.65.75" dst_port="5000"/>
        </slice>
        <from usec="0" sec="1362287333"/>
        <to usec="0" sec="1362287477"/>
    </anomaly>
    <anomaly type="anomalous" value="1.353990,1.225740,020,0 0 0 1 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="209.146.104.48"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287453"/>
    </anomaly>
    <anomaly type="anomalous" value="1.116310,1.078980,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="139.92.240.178" src_port="80"/>
        </slice>
        <from usec="0" sec="1362286804"/>
        <to usec="0" sec="1362287629"/>
    </anomaly>
    <anomaly type="anomalous" value="1.104370,1.035210,503,0 0 0 1 1 1 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="209.146.105.197" src_port="80"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287629"/>
    </anomaly>
    <anomaly type="anomalous" value="1.116310,1.078980,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="208.146.23.208" dst_port="80"/>
        </slice>
        <from usec="0" sec="1362286803"/>
        <to usec="0" sec="1362286999"/>
    </anomaly>
    <anomaly type="anomalous" value="1.104370,1.035210,503,0 0 0 1 1 1 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="139.92.243.54" src_port="80"/>
            <filter dst_ip="139.92.243.54" src_port="443"/>
        </slice>
        <from usec="0" sec="1362286821"/>
        <to usec="0" sec="1362286999"/>
    </anomaly>
    <anomaly type="anomalous" value="1.116310,1.078980,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="139.92.240.224" dst_ip="144.193.199.38" dst_port="80"/>
            <filter src_ip="139.92.240.224" dst_ip="84.158.74.141" dst_port="80"/>
            <filter src_ip="139.92.240.224" dst_ip="84.158.74.137" dst_port="80"/>
        </slice>
        <from usec="0" sec="1362286831"/>
        <to usec="0" sec="1362286999"/>
    </anomaly>
    <anomaly type="anomalous" value="1.116310,1.078980,504,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="139.92.242.71" dst_ip="158.38.252.22" src_port="37582" dst_port="443"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287089"/>
    </anomaly>
    <anomaly type="anomalous" value="1.116310,1.078980,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="139.92.40.234" dst_ip="28.2.38.96" src_port="80" dst_port="15283"/>
            <filter src_ip="139.92.40.234" dst_ip="28.2.38.96" src_port="80" dst_port="15157"/>
            <filter src_ip="139.92.40.234" dst_ip="28.2.38.96" src_port="80" dst_port="15156"/>
            <filter src_ip="139.92.40.234" dst_ip="28.2.38.96" src_port="80" dst_port="15129"/>
            <filter src_ip="139.92.40.234" dst_ip="28.2.38.96" src_port="80" dst_port="15128"/>
        </slice>
        <from usec="0" sec="1362286813"/>
        <to usec="0" sec="1362287035"/>
    </anomaly>
    <anomaly type="anomalous" value="1.116310,1.078980,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="33.8.172.153" dst_ip="139.92.243.22" src_port="80"/>
        </slice>
        <from usec="0" sec="1362287001"/>
        <to usec="0" sec="1362287173"/>
    </anomaly>
    <anomaly type="anomalous" value="1.116310,1.078980,503,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="139.92.240.178" src_port="80"/>
            <filter dst_ip="139.92.240.146" src_port="80"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287629"/>
    </anomaly>
    <anomaly type="anomalous" value="1.116310,1.078980,503,0 0 0 1 1 1 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="107.51.83.39" dst_ip="209.146.105.192" dst_port="80"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287515"/>
    </anomaly>
    <anomaly type="anomalous" value="1.116310,1.078980,503,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="126.220.28.226" src_port="80"/>
            <filter dst_ip="208.158.112.99" src_port="80"/>
            <filter dst_ip="208.158.112.99" dst_port="25"/>
            <filter dst_ip="209.146.98.243" dst_port="25"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287623"/>
    </anomaly>
    <anomaly type="anomalous" value="1.104370,1.035210,503,0 0 0 1 1 1 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="112.64.229.113" dst_ip="176.232.13.202" src_port="80"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287539"/>
    </anomaly>
    <anomaly type="anomalous" value="1.112080,1.047780,503,1 1 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="144.206.53.44" dst_ip="209.146.100.197" dst_port="80"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362286937"/>
    </anomaly>
    <anomaly type="anomalous" value="1.514950,1.291820,020,0 0 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="209.146.104.49"/>
            <filter dst_ip="209.146.99.98"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287629"/>
    </anomaly>
    <anomaly type="anomalous" value="1.353990,1.225740,020,0 0 0 1 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="209.146.104.49"/>
        </slice>
        <from usec="0" sec="1362286802"/>
        <to usec="0" sec="1362287538"/>
    </anomaly>
    <anomaly type="anomalous" value="1.112080,1.047780,503,1 1 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="144.206.53.44" dst_ip="209.146.100.197" dst_port="80"/>
        </slice>
        <from usec="0" sec="1362286977"/>
        <to usec="0" sec="1362287432"/>
    </anomaly>
    <anomaly type="anomalous" value="1.329050,1.229050,011,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="2.231.217.196" src_port="80" dst_port="1024"/>
            <filter src_ip="122.49.213.21" src_port="80" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1362287026"/>
        <to usec="0" sec="1362287387"/>
    </anomaly>
    <anomaly type="anomalous" value="1.514950,1.291820,020,0 0 0 1 1 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="209.146.99.98"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287477"/>
    </anomaly>
    <anomaly type="anomalous" value="1.329050,1.229050,011,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="2.231.217.196" src_port="80" dst_port="3072"/>
            <filter src_ip="122.49.213.21" src_port="80" dst_port="3072"/>
        </slice>
        <from usec="0" sec="1362287026"/>
        <to usec="0" sec="1362287072"/>
    </anomaly>
    <anomaly type="anomalous" value="1.329050,1.229050,999,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1362287026"/>
        <to usec="0" sec="1362287072"/>
    </anomaly>
    <anomaly type="anomalous" value="1.329050,1.229050,010,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="4935" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1362287026"/>
        <to usec="0" sec="1362287072"/>
    </anomaly>
    <anomaly type="anomalous" value="1.329050,1.229050,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="209.146.99.113"/>
        </slice>
        <from usec="0" sec="1362287026"/>
        <to usec="0" sec="1362287072"/>
    </anomaly>
    <anomaly type="anomalous" value="1.329050,1.229050,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="209.146.104.58"/>
        </slice>
        <from usec="0" sec="1362287026"/>
        <to usec="0" sec="1362287117"/>
    </anomaly>
    <anomaly type="anomalous" value="1.329050,1.229050,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="208.63.178.214" src_port="53" dst_port="1001"/>
        </slice>
        <from usec="0" sec="1362287026"/>
        <to usec="0" sec="1362287072"/>
    </anomaly>
    <anomaly type="suspicious" value="0.747607,0.943131,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="176.236.112.220" dst_ip="29.79.255.47" src_port="3376" dst_port="21431" proto="udp"/>
        </slice>
        <from usec="0" sec="1362286853"/>
        <to usec="0" sec="1362287612"/>
    </anomaly>
    <anomaly type="suspicious" value="0.747607,0.943131,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="209.146.106.157" dst_ip="92.160.99.24" src_port="80" dst_port="57148" proto="tcp"/>
        </slice>
        <from usec="0" sec="1362286866"/>
        <to usec="0" sec="1362286870"/>
    </anomaly>
    <anomaly type="suspicious" value="0.747607,0.943131,999,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="209.146.106.156" dst_ip="16.226.113.1" src_port="53" proto="udp"/>
        </slice>
        <from usec="0" sec="1362286882"/>
        <to usec="0" sec="1362286885"/>
    </anomaly>
    <anomaly type="suspicious" value="0.747607,0.943131,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="176.3.90.150" dst_ip="33.48.166.245" src_port="50271" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1362287306"/>
        <to usec="0" sec="1362287310"/>
    </anomaly>
    <anomaly type="suspicious" value="0.747607,0.943131,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="95.50.172.47" dst_ip="181.190.197.65" src_port="80" dst_port="61321" proto="tcp"/>
        </slice>
        <from usec="0" sec="1362287352"/>
        <to usec="0" sec="1362287354"/>
    </anomaly>
    <anomaly type="suspicious" value="0.747607,0.943131,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="139.92.35.105" dst_ip="220.130.92.241" src_port="51419" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1362286843"/>
        <to usec="0" sec="1362286855"/>
    </anomaly>
    <anomaly type="suspicious" value="0.747607,0.943131,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="97.52.83.133" dst_port="445" proto="tcp"/>
        </slice>
        <from usec="0" sec="1362286849"/>
        <to usec="0" sec="1362286950"/>
    </anomaly>
    <anomaly type="suspicious" value="0.747607,0.943131,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="103.3.124.175" dst_port="5000"/>
        </slice>
        <from usec="0" sec="1362287591"/>
        <to usec="0" sec="1362287595"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791106,0.938814,503,1 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="126.220.28.135" dst_ip="139.92.145.130" src_port="80" dst_port="51570"/>
            <filter src_ip="195.37.13.29" dst_ip="139.92.145.130" src_port="80" dst_port="51081"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287359"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791106,0.938814,503,1 0 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="139.92.243.109" src_port="80"/>
        </slice>
        <from usec="0" sec="1362286802"/>
        <to usec="0" sec="1362287448"/>
    </anomaly>
    <anomaly type="suspicious" value="0.817124,0.968887,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287539"/>
    </anomaly>
    <anomaly type="suspicious" value="0.847025,1.002980,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1362286801"/>
        <to usec="0" sec="1362287359"/>
    </anomaly>
</admd:annotation>
