<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.386670,1.908360,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="54.136.43.138" src_port="43766" dst_port="6666"/>
        </slice>
        <from usec="0" sec="1367730056"/>
        <to usec="0" sec="1367730060"/>
    </anomaly>
    <anomaly type="anomalous" value="2.386670,1.908360,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="45.167.233.73" dst_port="6671"/>
        </slice>
        <from usec="0" sec="1367730583"/>
        <to usec="0" sec="1367730631"/>
    </anomaly>
    <anomaly type="anomalous" value="2.386670,1.908360,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="76.56.134.71" src_port="1433" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1367730839"/>
        <to usec="0" sec="1367730856"/>
    </anomaly>
    <anomaly type="anomalous" value="1.848530,1.574250,011,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="54.136.43.138" src_port="6666" dst_port="43766"/>
        </slice>
        <from usec="0" sec="1367730056"/>
        <to usec="0" sec="1367730059"/>
    </anomaly>
    <anomaly type="anomalous" value="2.386670,1.908360,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="37.41.96.141" src_port="6000" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1367730817"/>
        <to usec="0" sec="1367730882"/>
    </anomaly>
    <anomaly type="anomalous" value="1.387140,1.369720,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="182.212.129.237" dst_ip="21.108.123.26" src_port="80"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730828"/>
    </anomaly>
    <anomaly type="anomalous" value="1.694090,1.487310,503,0 0 0 1 1 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.250.148.117" dst_port="80"/>
            <filter dst_ip="200.250.148.117"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730496"/>
    </anomaly>
    <anomaly type="anomalous" value="1.387140,1.369720,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="145.211.66.104" src_port="80"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730288"/>
    </anomaly>
    <anomaly type="anomalous" value="2.716330,1.983810,010,1 1 1 1 1 1 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.56.134.71" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730861"/>
    </anomaly>
    <anomaly type="anomalous" value="1.387140,1.369720,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="200.250.144.132" src_port="80"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730735"/>
    </anomaly>
    <anomaly type="anomalous" value="1.387140,1.369720,999,0 0 0 1 1 1 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="200.250.158.46" dst_ip="219.232.68.23" dst_port="21001"/>
            <filter src_ip="200.250.158.46" dst_ip="87.139.79.248" dst_port="21001"/>
        </slice>
        <from usec="0" sec="1367730001"/>
        <to usec="0" sec="1367730377"/>
    </anomaly>
    <anomaly type="anomalous" value="2.398830,1.763280,503,1 1 0 1 1 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.250.144.132" dst_port="80"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730643"/>
    </anomaly>
    <anomaly type="anomalous" value="1.387140,1.369720,503,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="99.65.101.124" src_port="80"/>
            <filter src_ip="99.65.101.124" src_port="443"/>
            <filter dst_ip="145.211.67.116" src_port="80"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730738"/>
    </anomaly>
    <anomaly type="anomalous" value="1.694090,1.487310,503,0 0 0 1 1 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.250.154.91" dst_port="80"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730828"/>
    </anomaly>
    <anomaly type="anomalous" value="1.387140,1.369720,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="211.35.118.150" dst_ip="145.211.20.55" src_port="80"/>
            <filter src_ip="211.35.118.149" dst_ip="145.211.20.55" src_port="80"/>
        </slice>
        <from usec="0" sec="1367730257"/>
        <to usec="0" sec="1367730819"/>
    </anomaly>
    <anomaly type="anomalous" value="3.067740,2.218090,020,1 1 1 1 1 1 1 1 1 0 0 0,ntscICecrqICecrqdurmterp">
        <slice>
            <filter dst_ip="200.250.148.97"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730738"/>
    </anomaly>
    <anomaly type="anomalous" value="1.852320,1.458070,053,1 1 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="200.250.152.167" src_port="80"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730901"/>
    </anomaly>
    <anomaly type="anomalous" value="2.670560,1.938130,053,1 1 0 1 1 1 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.250.152.167" dst_port="80"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730899"/>
    </anomaly>
    <anomaly type="anomalous" value="1.387140,1.369720,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="177.244.209.203" src_port="80"/>
            <filter src_ip="17.89.71.190" dst_ip="177.244.209.203" src_port="443"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730558"/>
    </anomaly>
    <anomaly type="anomalous" value="1.387140,1.369720,999,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="34.27.32.16" dst_ip="200.250.158.46"/>
            <filter src_ip="47.192.28.218" dst_ip="200.250.158.46"/>
            <filter dst_ip="200.250.158.46" dst_port="3001"/>
            <filter dst_ip="200.250.158.46"/>
        </slice>
        <from usec="0" sec="1367730001"/>
        <to usec="0" sec="1367730377"/>
    </anomaly>
    <anomaly type="anomalous" value="2.716330,1.983810,010,1 1 1 1 1 1 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.8.209.208" dst_port="6674"/>
        </slice>
        <from usec="0" sec="1367730540"/>
        <to usec="0" sec="1367730586"/>
    </anomaly>
    <anomaly type="anomalous" value="1.387140,1.369720,503,0 0 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="200.250.154.91" src_port="80"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730828"/>
    </anomaly>
    <anomaly type="anomalous" value="1.550490,1.475320,020,0 0 0 1 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="200.250.155.32" dst_port="80"/>
            <filter src_ip="200.250.155.32"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730738"/>
    </anomaly>
    <anomaly type="anomalous" value="1.694090,1.487310,020,0 0 0 1 1 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="200.250.155.32" dst_port="18240"/>
            <filter dst_ip="200.250.155.32"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730361"/>
    </anomaly>
    <anomaly type="anomalous" value="1.694090,1.487310,999,0 0 0 1 1 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="200.250.148.169" dst_port="58292"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730738"/>
    </anomaly>
    <anomaly type="anomalous" value="1.694090,1.487310,999,0 0 0 1 1 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="201.34.216.151" dst_port="53"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730737"/>
    </anomaly>
    <anomaly type="anomalous" value="1.694090,1.487310,020,0 0 0 1 1 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="200.250.155.47" dst_port="16708"/>
            <filter dst_ip="200.250.155.47"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730721"/>
    </anomaly>
    <anomaly type="anomalous" value="1.550490,1.475320,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.250.150.228" dst_port="123"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730198"/>
    </anomaly>
    <anomaly type="anomalous" value="1.925550,1.573850,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="32.128.108.89" dst_port="445"/>
            <filter src_ip="32.128.108.89" dst_port="139"/>
        </slice>
        <from usec="0" sec="1367730540"/>
        <to usec="0" sec="1367730591"/>
    </anomaly>
    <anomaly type="anomalous" value="1.689940,1.601370,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="145.211.194.136" dst_port="80"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730046"/>
    </anomaly>
    <anomaly type="anomalous" value="1.689940,1.601370,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.250.145.124" dst_port="53"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730046"/>
    </anomaly>
    <anomaly type="anomalous" value="1.689940,1.601370,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.250.145.121" dst_port="53"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730046"/>
    </anomaly>
    <anomaly type="anomalous" value="1.689940,1.601370,503,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="182.212.161.196" dst_ip="26.44.184.45" dst_port="80"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.308890,1.488940,999,0 0 0 0 0 0 0 0 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="182.212.91.67" dst_ip="177.31.229.84" src_port="53"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,999,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="200.250.148.169" dst_port="58292"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.106080,1.241300,999,0 0 0 1 0 0 1 1 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="201.34.216.63" dst_ip="108.88.237.246"/>
            <filter src_ip="201.34.216.63" dst_ip="62.26.143.162"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730554"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="145.211.67.85" src_port="33048"/>
            <filter src_ip="145.211.67.85" dst_port="80"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730198"/>
    </anomaly>
    <anomaly type="suspicious" value="1.314240,1.365530,999,0 0 0 1 1 0 0 0 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="201.34.216.63" dst_ip="62.26.143.162"/>
            <filter src_ip="201.34.216.63" dst_ip="108.88.237.246"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730828"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="101.131.178.20" dst_ip="145.211.66.248" src_port="443"/>
            <filter src_ip="101.131.178.20" dst_ip="145.211.67.204" src_port="443"/>
            <filter src_ip="101.131.178.20" dst_ip="145.211.66.34" src_port="443"/>
        </slice>
        <from usec="0" sec="1367730010"/>
        <to usec="0" sec="1367730182"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="24.100.77.148" dst_ip="145.211.131.0" src_port="80" dst_port="54132"/>
            <filter src_ip="24.100.77.148" dst_ip="145.211.131.0" src_port="80" dst_port="54130"/>
            <filter src_ip="24.100.77.148" dst_ip="145.211.131.0" src_port="80" dst_port="54126"/>
        </slice>
        <from usec="0" sec="1367730143"/>
        <to usec="0" sec="1367730164"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,504,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="105.170.116.247" dst_ip="182.212.161.217"/>
            <filter src_ip="105.170.116.247" src_port="443"/>
            <filter src_ip="105.170.116.231" dst_ip="182.212.161.217"/>
            <filter src_ip="105.170.116.231" src_port="443"/>
            <filter dst_ip="182.212.161.217" src_port="443"/>
            <filter src_ip="143.134.137.231" dst_ip="182.212.161.217" src_port="80"/>
        </slice>
        <from usec="0" sec="1367730223"/>
        <to usec="0" sec="1367730377"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="177.244.87.112" dst_ip="21.147.209.70" dst_port="443"/>
        </slice>
        <from usec="0" sec="1367730145"/>
        <to usec="0" sec="1367730430"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="211.35.118.46" dst_ip="145.211.18.232" src_port="80" dst_port="60318"/>
            <filter src_ip="211.35.118.46" dst_ip="145.211.18.232" src_port="80" dst_port="60317"/>
            <filter src_ip="211.35.118.46" dst_ip="145.211.18.232" src_port="80" dst_port="60283"/>
            <filter src_ip="211.35.118.46" dst_ip="145.211.18.232" src_port="80" dst_port="60282"/>
            <filter src_ip="131.87.153.147" dst_ip="145.211.18.232"/>
        </slice>
        <from usec="0" sec="1367730500"/>
        <to usec="0" sec="1367730638"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="145.211.136.197" src_port="80"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730824"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="145.211.81.75" dst_ip="152.66.174.39" src_port="80"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730594"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="118.85.180.72" dst_ip="200.250.150.215" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1367730001"/>
        <to usec="0" sec="1367730564"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="145.211.35.224" src_port="33252"/>
        </slice>
        <from usec="0" sec="1367730002"/>
        <to usec="0" sec="1367730737"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,020,0 0 0 1 1 0 0 0 0 0 0 0,hostout">
        <slice>
            <filter src_ip="145.211.205.192"/>
        </slice>
        <from usec="0" sec="1367730006"/>
        <to usec="0" sec="1367730735"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,504,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="182.212.71.110" dst_port="443"/>
            <filter dst_ip="136.58.111.138" dst_port="443"/>
            <filter dst_ip="136.58.111.138" dst_port="80"/>
            <filter dst_ip="196.1.20.228" dst_port="443"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730735"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="196.17.158.212" dst_ip="145.211.66.250" src_port="80"/>
            <filter src_ip="196.17.158.212" dst_ip="201.34.213.60" src_port="80"/>
        </slice>
        <from usec="0" sec="1367730243"/>
        <to usec="0" sec="1367730738"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.113.133.194" dst_ip="145.211.67.201" src_port="443"/>
            <filter src_ip="133.113.133.194" dst_ip="145.211.88.101" src_port="80"/>
        </slice>
        <from usec="0" sec="1367730478"/>
        <to usec="0" sec="1367730688"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="160.198.107.110" dst_ip="86.110.29.41" src_port="80" dst_port="49832"/>
            <filter src_ip="160.198.107.110" dst_ip="86.110.29.41" src_port="80" dst_port="49831"/>
        </slice>
        <from usec="0" sec="1367730541"/>
        <to usec="0" sec="1367730610"/>
    </anomaly>
    <anomaly type="suspicious" value="0.739357,1.108560,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="223.208.26.198" dst_ip="200.250.155.33" src_port="62085" dst_port="80"/>
            <filter src_ip="223.208.26.198" dst_ip="200.250.155.33" src_port="40989" dst_port="80"/>
        </slice>
        <from usec="0" sec="1367730601"/>
        <to usec="0" sec="1367730627"/>
    </anomaly>
    <anomaly type="suspicious" value="1.106080,1.241300,020,0 0 0 1 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="200.250.155.47"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730647"/>
    </anomaly>
    <anomaly type="suspicious" value="1.106080,1.241300,999,0 0 0 1 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="145.211.225.46" dst_ip="193.60.147.57" dst_port="53"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730198"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907354,1.256960,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.250.154.68"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907354,1.256960,504,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="182.201.149.51"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907354,1.256960,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="200.250.144.250"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907354,1.256960,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="202.83.156.133" src_port="80"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907354,1.256960,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.250.145.121" dst_port="53"/>
        </slice>
        <from usec="0" sec="1367730090"/>
        <to usec="0" sec="1367730136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907354,1.256960,010,0 0 0 0 0 0 1 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="128.178.175.11" dst_port="80"/>
        </slice>
        <from usec="0" sec="1367730090"/>
        <to usec="0" sec="1367730136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907354,1.256960,999,0 0 0 0 0 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="145.211.224.52" dst_ip="193.60.147.57" dst_port="53"/>
        </slice>
        <from usec="0" sec="1367730090"/>
        <to usec="0" sec="1367730136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907354,1.256960,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="197.160.59.7" src_port="25565"/>
        </slice>
        <from usec="0" sec="1367730225"/>
        <to usec="0" sec="1367730271"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907354,1.256960,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="182.34.174.136"/>
        </slice>
        <from usec="0" sec="1367730315"/>
        <to usec="0" sec="1367730361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907354,1.256960,053,0 0 0 0 0 0 1 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="45.139.216.226"/>
        </slice>
        <from usec="0" sec="1367730315"/>
        <to usec="0" sec="1367730361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907354,1.256960,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="201.208.20.253"/>
        </slice>
        <from usec="0" sec="1367730315"/>
        <to usec="0" sec="1367730361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907354,1.256960,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.250.145.124" src_port="53"/>
            <filter dst_ip="200.250.145.124" dst_port="53"/>
        </slice>
        <from usec="0" sec="1367730315"/>
        <to usec="0" sec="1367730361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907354,1.256960,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.250.145.121" dst_port="53"/>
        </slice>
        <from usec="0" sec="1367730315"/>
        <to usec="0" sec="1367730361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907354,1.256960,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="145.211.218.97"/>
        </slice>
        <from usec="0" sec="1367730315"/>
        <to usec="0" sec="1367730361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907354,1.256960,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="182.212.128.223"/>
        </slice>
        <from usec="0" sec="1367730315"/>
        <to usec="0" sec="1367730361"/>
    </anomaly>
    <anomaly type="suspicious" value="1.106080,1.241300,999,0 0 0 1 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.250.150.59" dst_port="26120"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.907354,1.256960,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="200.250.155.47" dst_port="80"/>
        </slice>
        <from usec="0" sec="1367730540"/>
        <to usec="0" sec="1367730631"/>
    </anomaly>
    <anomaly type="suspicious" value="1.294340,1.388750,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="31.226.13.182" dst_ip="177.244.6.145" dst_port="53"/>
            <filter src_ip="21.1.18.135" dst_ip="177.244.6.145" dst_port="53"/>
            <filter src_ip="56.44.235.20" dst_ip="177.244.6.145" dst_port="53"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.294340,1.388750,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="182.212.91.67" dst_ip="177.31.229.84" src_port="53"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.294340,1.388750,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="200.250.148.117" dst_ip="221.108.66.213" src_port="80"/>
        </slice>
        <from usec="0" sec="1367730000"/>
        <to usec="0" sec="1367730046"/>
    </anomaly>
</admd:annotation>
