<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.508170,1.452340,503,1 1 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="165.187.205.189" dst_ip="48.86.78.55"/>
            <filter src_ip="165.187.205.189" dst_port="80"/>
            <filter dst_ip="48.86.78.55" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.325710,2.165040,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="195.70.155.180" dst_ip="148.255.151.238" src_port="8080" dst_port="19"/>
        </slice>
        <from usec="0" sec="1375938594"/>
        <to usec="0" sec="1375938900"/>
    </anomaly>
    <anomaly type="anomalous" value="1.740880,1.446280,503,1 1 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="139.255.218.51" dst_ip="117.41.85.212"/>
            <filter src_ip="139.255.218.51" dst_port="443"/>
            <filter dst_ip="117.41.85.212" dst_port="80"/>
            <filter dst_ip="117.41.85.212" dst_port="443"/>
            <filter src_ip="139.255.218.51" dst_ip="51.56.172.169" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.552050,1.613780,503,1 1 0 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="192.18.96.209" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.325710,2.165040,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="210.144.186.2" dst_port="23"/>
        </slice>
        <from usec="0" sec="1375938735"/>
        <to usec="0" sec="1375938736"/>
    </anomaly>
    <anomaly type="anomalous" value="1.440300,1.279380,503,0 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="193.208.159.80" dst_port="80"/>
            <filter src_ip="193.208.159.80" dst_port="443"/>
            <filter dst_ip="52.131.231.94" dst_port="80"/>
            <filter dst_ip="52.131.231.94" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.240700,1.466830,503,0 0 0 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="193.208.159.80" src_port="80"/>
            <filter dst_ip="193.208.159.80" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.846360,1.432530,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="192.18.96.209" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.608550,2.085130,503,1 1 1 1 1 0 1 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="193.219.167.209" dst_port="80"/>
            <filter src_ip="193.219.167.209" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.577250,1.463220,999,1 1 0 1 1 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="46.109.129.113" src_port="59524" dst_port="19"/>
        </slice>
        <from usec="0" sec="1375938007"/>
        <to usec="0" sec="1375938901"/>
    </anomaly>
    <anomaly type="anomalous" value="1.919930,1.317670,503,0 0 0 1 1 0 1 1 1 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="57.35.210.50" dst_ip="165.187.64.196" src_port="80"/>
            <filter src_ip="57.35.211.122" dst_ip="165.187.64.196" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.411970,1.354950,020,0 0 0 0 0 0 1 1 1 1 0 0,icmp_error">
        <slice>
            <filter dst_ip="192.18.97.5"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.960570,1.453270,504,1 1 0 1 0 0 1 1 1 1 1 0,mptp">
        <slice>
            <filter dst_ip="168.41.6.140" dst_port="443"/>
            <filter dst_ip="168.41.6.140" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.846360,1.432530,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="165.187.126.13" src_port="80"/>
            <filter dst_ip="165.187.126.13" src_port="443"/>
            <filter dst_ip="165.187.126.13" dst_port="49857"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.440300,1.279380,503,0 0 0 1 1 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="193.219.140.177" src_port="80"/>
            <filter dst_ip="193.219.140.177" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.846360,1.432530,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="124.152.4.116" dst_ip="165.187.103.209"/>
            <filter src_ip="124.152.4.116" src_port="80"/>
            <filter dst_ip="165.187.103.209" src_port="443"/>
            <filter dst_ip="165.187.103.209" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.240700,1.466830,503,0 0 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="148.255.54.161" src_port="80"/>
            <filter src_port="4935" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.282990,1.565200,503,1 1 0 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="148.255.80.227" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.199770,2.235340,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="208.76.39.115" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.353910,1.500460,503,1 0 0 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="192.18.106.17" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.353910,1.500460,503,1 0 0 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="192.18.107.64" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.846360,1.432530,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="165.187.226.33" src_port="80"/>
            <filter dst_ip="165.187.226.33" src_port="443"/>
            <filter dst_ip="165.187.226.33" dst_port="34499"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.240700,1.466830,503,0 0 0 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="193.219.167.209" src_port="80"/>
            <filter dst_ip="193.219.167.209" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.919930,1.317670,503,0 0 0 1 1 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="180.132.111.122" src_port="80"/>
            <filter dst_ip="165.187.135.14" src_port="80"/>
            <filter dst_ip="148.255.36.29" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.615720,1.404630,503,0 0 0 1 1 1 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="145.173.130.32" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.085530,1.433640,503,0 0 0 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="145.0.96.90" src_port="80"/>
            <filter dst_ip="145.0.96.90" src_port="443"/>
            <filter dst_ip="192.18.104.122" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.774850,1.318490,999,0 0 0 1 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="192.18.102.209" src_port="123"/>
            <filter dst_ip="192.18.102.209" dst_port="123"/>
            <filter src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.919930,1.317670,503,0 0 0 1 1 0 1 1 1 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="192.18.107.64" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.297440,1.514910,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="165.187.237.42" dst_ip="160.174.68.200" src_port="53537" dst_port="80"/>
            <filter src_ip="165.187.237.42" dst_ip="160.174.68.200" src_port="53536" dst_port="80"/>
            <filter src_ip="165.187.237.42" dst_ip="160.174.68.200" src_port="53535" dst_port="80"/>
        </slice>
        <from usec="0" sec="1375938784"/>
        <to usec="0" sec="1375938796"/>
    </anomaly>
    <anomaly type="suspicious" value="1.297440,1.514910,901,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="148.255.100.143" dst_ip="197.38.168.81" dst_port="80"/>
            <filter src_ip="148.255.100.143" dst_ip="177.83.80.160" dst_port="80"/>
        </slice>
        <from usec="0" sec="1375938624"/>
        <to usec="0" sec="1375938637"/>
    </anomaly>
    <anomaly type="suspicious" value="1.353440,1.446530,999,1 1 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="193.219.167.164" dst_port="25"/>
            <filter dst_ip="165.187.68.134" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.297440,1.514910,999,1 1 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="104.81.221.36" dst_ip="192.18.102.134" dst_port="19"/>
            <filter src_ip="37.221.217.175" dst_ip="192.18.102.134" dst_port="19"/>
        </slice>
        <from usec="0" sec="1375938570"/>
        <to usec="0" sec="1375938822"/>
    </anomaly>
    <anomaly type="suspicious" value="1.297440,1.514910,999,1 1 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="202.229.228.38" dst_port="53"/>
            <filter dst_ip="202.229.228.38" src_port="53" dst_port="63186"/>
        </slice>
        <from usec="0" sec="1375938588"/>
        <to usec="0" sec="1375938592"/>
    </anomaly>
    <anomaly type="suspicious" value="1.412130,1.496630,002,1 1 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="28.32.197.69" src_port="1025" dst_port="137"/>
        </slice>
        <from usec="0" sec="1375938495"/>
        <to usec="0" sec="1375938541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.297440,1.514910,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="202.139.115.30" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1375938522"/>
        <to usec="0" sec="1375938533"/>
    </anomaly>
    <anomaly type="suspicious" value="1.297440,1.514910,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="37.210.57.3" dst_port="445"/>
        </slice>
        <from usec="0" sec="1375938515"/>
        <to usec="0" sec="1375938519"/>
    </anomaly>
    <anomaly type="suspicious" value="1.297440,1.514910,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="190.216.109.89" dst_port="139"/>
        </slice>
        <from usec="0" sec="1375938094"/>
        <to usec="0" sec="1375938139"/>
    </anomaly>
    <anomaly type="suspicious" value="1.297440,1.514910,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="190.76.15.146" dst_port="445"/>
            <filter src_ip="190.76.15.146" dst_port="139"/>
        </slice>
        <from usec="0" sec="1375938610"/>
        <to usec="0" sec="1375938665"/>
    </anomaly>
    <anomaly type="suspicious" value="0.935728,1.279670,503,0 0 0 1 1 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="165.187.205.203" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.235190,1.502520,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.342680,1.393430,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="148.255.241.52" src_port="53"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.342680,1.393430,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="193.106.47.51" dst_ip="192.168.122.2" src_port="53"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.342680,1.393430,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="171.104.157.41" dst_ip="148.255.241.56" src_port="53"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.063740,1.358450,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="145.173.67.84" src_port="53"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.342680,1.393430,020,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.18.107.72"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.342680,1.393430,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="167.86.120.5" src_port="53"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.342680,1.393430,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="165.187.19.30" src_port="53"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.342680,1.393430,010,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="104.215.11.179" dst_ip="131.49.27.27" src_port="80"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.342680,1.393430,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.18.101.7" dst_port="80"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.342680,1.393430,999,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="213.89.129.241" dst_ip="193.208.24.20" dst_port="53"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.342680,1.393430,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.18.101.25" dst_port="80"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.342680,1.393430,051,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="139.255.162.14" dst_ip="0.2.126.244" dst_port="21"/>
            <filter src_ip="139.255.224.119" dst_ip="0.2.126.244" dst_port="21"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326790,1.358280,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="192.18.97.76" src_port="53"/>
            <filter dst_ip="192.18.97.76" dst_port="53"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938642"/>
    </anomaly>
    <anomaly type="suspicious" value="1.342680,1.393430,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="193.219.167.149" dst_port="80"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.342680,1.393430,999,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="193.208.11.88" dst_ip="10.64.51.185" dst_port="12500"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326790,1.358280,999,0 0 0 1 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="192.18.96.139" dst_ip="205.99.19.195" dst_port="53"/>
            <filter src_ip="192.18.96.139" dst_ip="198.74.174.239" dst_port="53"/>
        </slice>
        <from usec="0" sec="1375938001"/>
        <to usec="0" sec="1375938684"/>
    </anomaly>
    <anomaly type="suspicious" value="1.063740,1.358450,010,0 0 0 0 0 0 1 1 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="49.84.65.43" dst_ip="145.140.177.106"/>
        </slice>
        <from usec="0" sec="1375938450"/>
        <to usec="0" sec="1375938541"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928646,1.392290,503,0 0 0 0 0 0 0 0 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="165.187.44.224" dst_port="80"/>
        </slice>
        <from usec="0" sec="1375938000"/>
        <to usec="0" sec="1375938046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.860185,1.248930,503,0 0 0 1 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="145.28.103.23" dst_ip="4.46.44.224" src_port="80"/>
            <filter src_ip="145.28.103.23" dst_ip="204.148.16.41" src_port="80"/>
            <filter src_ip="145.28.103.23" dst_ip="4.46.44.200" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.935728,1.279670,999,0 0 0 1 1 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="192.18.102.134" dst_ip="104.81.221.36" src_port="19"/>
            <filter src_ip="192.18.102.134" dst_ip="37.221.217.175" src_port="19"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.860185,1.248930,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="208.109.44.57" dst_ip="165.187.129.27" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.257310,1.317470,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="148.255.92.57" src_port="80"/>
            <filter dst_ip="148.255.92.57" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.860185,1.248930,999,0 0 0 1 0 0 0 0 0 1 1 0,ipv46tun">
        <slice>
            <filter src_ip="192.18.96.164" dst_ip="129.29.73.85"/>
            <filter src_ip="192.18.96.164" dst_ip="204.241.37.234" src_port="80" dst_port="18232"/>
            <filter src_ip="192.18.96.164" dst_ip="208.76.39.115" src_port="3389" dst_port="48988"/>
            <filter src_ip="192.151.13.92" dst_ip="129.29.73.85"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.884502,1.287080,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="74.53.232.78" dst_ip="165.187.205.246" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.257310,1.317470,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="165.187.130.111" src_port="80"/>
            <filter dst_ip="165.187.130.111" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.141290,1.325280,504,1 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="148.255.2.82" dst_ip="80.18.150.38" src_port="50135" dst_port="443"/>
            <filter src_ip="148.255.202.78" dst_ip="80.18.150.38" src_port="55495" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129580,1.248060,504,0 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="59.132.139.115" src_port="443"/>
            <filter dst_ip="148.255.117.143" src_port="443"/>
            <filter dst_ip="148.255.117.143" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.257310,1.317470,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter src_ip="73.16.211.170" dst_ip="165.187.44.192"/>
            <filter src_ip="73.16.211.170" dst_port="443"/>
            <filter dst_ip="165.187.44.192" dst_port="80"/>
            <filter src_ip="171.74.245.141" dst_ip="165.187.44.192" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.884502,1.287080,504,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="165.187.146.85" dst_port="443"/>
            <filter src_ip="145.173.14.14" dst_ip="52.126.9.250" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.884502,1.287080,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="145.173.102.132" dst_port="80"/>
            <filter src_ip="145.173.102.132" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.884502,1.287080,504,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="145.28.162.229" dst_ip="205.72.6.101" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.257310,1.317470,504,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="165.187.64.196" dst_ip="205.72.6.97" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.884502,1.287080,999,0 0 0 0 0 0 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="192.18.96.31" dst_ip="196.5.124.186"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.860185,1.248930,503,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="8.209.63.77" dst_ip="148.255.110.68"/>
            <filter src_ip="8.209.63.77" src_port="80"/>
            <filter dst_ip="145.28.205.20" src_port="80"/>
            <filter dst_ip="148.255.110.68" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.884502,1.287080,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="148.255.58.31" dst_ip="12.230.211.128" src_port="50166" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.884502,1.287080,999,0 0 0 0 0 0 0 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="148.255.37.105" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.884502,1.287080,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="193.208.157.27" dst_ip="131.99.42.48" src_port="80"/>
            <filter src_ip="145.28.135.85" dst_ip="131.99.42.48" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.257310,1.317470,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="193.218.11.16" dst_ip="165.187.103.215" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.884502,1.287080,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="165.187.212.83" src_port="443"/>
            <filter dst_ip="165.187.212.83" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.884502,1.287080,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="148.255.58.31" dst_ip="122.99.72.50" src_port="50216" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.257310,1.317470,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="148.255.2.82" dst_ip="122.99.80.214" src_port="52696" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.884502,1.287080,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="148.255.58.31" dst_ip="122.96.242.12" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.860185,1.248930,504,0 0 0 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="145.173.2.38" dst_port="80"/>
            <filter src_ip="145.173.2.38" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.884502,1.287080,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="165.187.205.246" dst_ip="74.53.232.78" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
