<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.609390,1.193140,503,1 1 1 1 1 1 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.49.107.198" src_port="53"/>
            <filter dst_ip="202.49.107.198" src_port="80"/>
        </slice>
        <from usec="0" sec="1365051601"/>
        <to usec="0" sec="1365052502"/>
    </anomaly>
    <anomaly type="anomalous" value="1.609390,1.193140,010,1 1 1 1 1 1 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="47.1.9.101" src_port="44230" dst_port="22"/>
        </slice>
        <from usec="0" sec="1365051781"/>
        <to usec="0" sec="1365051974"/>
    </anomaly>
    <anomaly type="anomalous" value="1.568510,1.196650,010,1 1 1 1 1 1 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="37.231.140.118" src_port="6000" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1365051642"/>
        <to usec="0" sec="1365052034"/>
    </anomaly>
    <anomaly type="anomalous" value="1.568510,1.196650,503,1 1 1 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="205.95.199.161" dst_ip="203.160.235.188" src_port="80" dst_port="62797"/>
            <filter src_ip="205.95.199.161" dst_ip="203.160.235.188" src_port="80" dst_port="62439"/>
            <filter src_ip="205.95.199.161" dst_ip="203.160.235.188" src_port="80" dst_port="61177"/>
        </slice>
        <from usec="0" sec="1365051601"/>
        <to usec="0" sec="1365052450"/>
    </anomaly>
    <anomaly type="anomalous" value="3.189480,2.404320,010,1 1 1 1 1 1 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="91.2.134.159" dst_port="6675"/>
        </slice>
        <from usec="0" sec="1365051601"/>
        <to usec="0" sec="1365052034"/>
    </anomaly>
    <anomaly type="anomalous" value="1.349380,1.240560,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.19.7.13" src_port="443"/>
            <filter dst_ip="163.19.7.13" src_port="80"/>
        </slice>
        <from usec="0" sec="1365051643"/>
        <to usec="0" sec="1365051887"/>
    </anomaly>
    <anomaly type="anomalous" value="1.609390,1.193140,503,1 1 1 1 1 1 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="202.49.81.161" dst_port="80"/>
            <filter src_ip="202.49.81.161" dst_port="53"/>
        </slice>
        <from usec="0" sec="1365051601"/>
        <to usec="0" sec="1365052501"/>
    </anomaly>
    <anomaly type="anomalous" value="1.568510,1.196650,503,1 1 1 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="203.160.237.99" src_port="80"/>
        </slice>
        <from usec="0" sec="1365051601"/>
        <to usec="0" sec="1365052450"/>
    </anomaly>
    <anomaly type="anomalous" value="1.349380,1.240560,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="37.236.203.94" dst_ip="152.161.88.201" src_port="80" dst_port="52002"/>
            <filter src_ip="37.236.203.94" dst_ip="152.161.88.201" src_port="80" dst_port="52001"/>
            <filter src_ip="37.236.203.94" dst_ip="152.161.88.201" src_port="80" dst_port="51982"/>
            <filter src_ip="37.236.203.94" dst_ip="152.161.88.201" src_port="80" dst_port="51981"/>
        </slice>
        <from usec="0" sec="1365051647"/>
        <to usec="0" sec="1365051709"/>
    </anomaly>
    <anomaly type="anomalous" value="1.349380,1.240560,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="186.172.204.195" dst_ip="152.161.135.82" src_port="80"/>
        </slice>
        <from usec="0" sec="1365051605"/>
        <to usec="0" sec="1365052060"/>
    </anomaly>
    <anomaly type="anomalous" value="1.349380,1.240560,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.19.5.106" src_port="80"/>
            <filter dst_ip="163.19.5.106" src_port="443"/>
        </slice>
        <from usec="0" sec="1365051602"/>
        <to usec="0" sec="1365052159"/>
    </anomaly>
    <anomaly type="anomalous" value="1.396690,1.237170,504,0 0 0 1 1 1 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="30.98.80.139" src_port="443"/>
            <filter src_ip="30.98.80.139" src_port="80"/>
        </slice>
        <from usec="0" sec="1365051601"/>
        <to usec="0" sec="1365052249"/>
    </anomaly>
    <anomaly type="anomalous" value="1.349380,1.240560,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="30.98.81.208" dst_ip="152.161.49.130" src_port="80" dst_port="42840"/>
            <filter src_ip="30.98.81.208" dst_ip="152.161.49.130" src_port="80" dst_port="42296"/>
        </slice>
        <from usec="0" sec="1365051693"/>
        <to usec="0" sec="1365051760"/>
    </anomaly>
    <anomaly type="anomalous" value="2.805120,2.336290,020,1 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="203.160.235.7" src_port="42189"/>
            <filter src_ip="203.160.235.23" dst_ip="190.22.214.52"/>
            <filter src_ip="203.160.235.23"/>
            <filter src_ip="203.160.235.23" dst_port="80"/>
            <filter src_ip="203.160.235.23"/>
            <filter dst_ip="190.22.214.52" dst_port="80"/>
        </slice>
        <from usec="0" sec="1365051601"/>
        <to usec="0" sec="1365052232"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927482,1.079230,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="209.151.233.205" dst_port="23"/>
        </slice>
        <from usec="0" sec="1365052482"/>
        <to usec="0" sec="1365052501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.909974,1.046730,999,1 1 0 1 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="202.203.107.151" src_port="53"/>
        </slice>
        <from usec="0" sec="1365051601"/>
        <to usec="0" sec="1365052485"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995057,1.075330,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="216.230.119.17" src_port="7341" dst_port="25"/>
        </slice>
        <from usec="0" sec="1365052456"/>
        <to usec="0" sec="1365052502"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927482,1.079230,502,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="214.89.150.203" dst_port="22"/>
        </slice>
        <from usec="0" sec="1365051601"/>
        <to usec="0" sec="1365051687"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995057,1.075330,020,1 1 1 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="209.151.233.205"/>
        </slice>
        <from usec="0" sec="1365052456"/>
        <to usec="0" sec="1365052502"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927482,1.079230,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="210.5.208.103" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1365052110"/>
        <to usec="0" sec="1365052111"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927482,1.079230,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="217.106.38.139" src_port="52648" dst_port="5038"/>
        </slice>
        <from usec="0" sec="1365052500"/>
        <to usec="0" sec="1365052502"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927482,1.079230,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="202.134.176.192" src_port="19462" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1365051661"/>
        <to usec="0" sec="1365051743"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927482,1.079230,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="196.72.181.218" src_port="80"/>
        </slice>
        <from usec="0" sec="1365052017"/>
        <to usec="0" sec="1365052133"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927482,1.079230,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="129.156.98.212" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1365051816"/>
        <to usec="0" sec="1365051827"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927482,1.079230,901,1 1 1 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="17.64.119.115" dst_ip="163.19.23.65" src_port="80"/>
        </slice>
        <from usec="0" sec="1365052262"/>
        <to usec="0" sec="1365052265"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927482,1.079230,502,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="153.147.11.216" dst_ip="194.60.72.12" src_port="44903" dst_port="22"/>
        </slice>
        <from usec="0" sec="1365051601"/>
        <to usec="0" sec="1365052501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995057,1.075330,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="120.4.235.83" dst_port="25"/>
        </slice>
        <from usec="0" sec="1365051601"/>
        <to usec="0" sec="1365051660"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927482,1.079230,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="35.189.37.1" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1365051684"/>
        <to usec="0" sec="1365051687"/>
    </anomaly>
    <anomaly type="suspicious" value="0.784340,1.086230,010,1 0 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="4.244.165.66" src_port="80"/>
        </slice>
        <from usec="0" sec="1365052206"/>
        <to usec="0" sec="1365052449"/>
    </anomaly>
    <anomaly type="suspicious" value="0.921440,1.178950,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1365051601"/>
        <to usec="0" sec="1365051709"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070540,1.183080,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="45.169.243.44" src_port="80"/>
        </slice>
        <from usec="0" sec="1365051659"/>
        <to usec="0" sec="1365052338"/>
    </anomaly>
    <anomaly type="suspicious" value="0.946349,1.187870,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1365051601"/>
        <to usec="0" sec="1365051709"/>
    </anomaly>
    <anomaly type="suspicious" value="0.728724,1.042060,504,1 1 0 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="152.161.171.96" dst_port="443"/>
            <filter dst_ip="31.23.160.138" dst_port="443"/>
        </slice>
        <from usec="0" sec="1365051601"/>
        <to usec="0" sec="1365052489"/>
    </anomaly>
    <anomaly type="suspicious" value="0.804827,1.128320,503,0 0 0 1 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="31.23.171.185" dst_port="80"/>
            <filter dst_ip="31.23.171.185" dst_port="443"/>
        </slice>
        <from usec="0" sec="1365051603"/>
        <to usec="0" sec="1365052187"/>
    </anomaly>
    <anomaly type="suspicious" value="0.804827,1.128320,020,0 0 0 1 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="152.161.185.131"/>
        </slice>
        <from usec="0" sec="1365051601"/>
        <to usec="0" sec="1365052249"/>
    </anomaly>
    <anomaly type="suspicious" value="0.728724,1.042060,503,1 1 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.160.227.80" dst_port="80"/>
        </slice>
        <from usec="0" sec="1365051610"/>
        <to usec="0" sec="1365052496"/>
    </anomaly>
    <anomaly type="suspicious" value="0.728724,1.042060,503,1 1 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.160.237.99" dst_port="80"/>
        </slice>
        <from usec="0" sec="1365051601"/>
        <to usec="0" sec="1365052489"/>
    </anomaly>
</admd:annotation>
