<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="4.343190,2.872010,010,1 1 1 1 1 1 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="216.158.6.15" src_port="43072" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.465110,2.556660,010,1 1 1 0 0 0 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="155.53.49.25" src_port="6000" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.777300,2.876340,010,1 1 1 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="8.142.105.115" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1381381418"/>
        <to usec="0" sec="1381381742"/>
    </anomaly>
    <anomaly type="anomalous" value="3.212950,2.549960,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="221.223.40.79" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1381381336"/>
        <to usec="0" sec="1381381382"/>
    </anomaly>
    <anomaly type="anomalous" value="2.292590,2.104910,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="121.173.99.98" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1381382044"/>
        <to usec="0" sec="1381382055"/>
    </anomaly>
    <anomaly type="anomalous" value="2.292590,2.104910,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="117.44.142.195" dst_port="445"/>
            <filter src_ip="117.44.142.195" dst_port="139"/>
        </slice>
        <from usec="0" sec="1381381939"/>
        <to usec="0" sec="1381381982"/>
    </anomaly>
    <anomaly type="anomalous" value="2.418420,2.101240,504,1 1 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="136.120.106.253" src_port="1042"/>
            <filter src_ip="136.120.106.253" dst_port="443"/>
        </slice>
        <from usec="0" sec="1381381227"/>
        <to usec="0" sec="1381381967"/>
    </anomaly>
    <anomaly type="anomalous" value="2.686710,2.089590,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="204.122.89.235" src_port="80"/>
            <filter src_ip="204.122.83.98" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.720010,2.075190,503,0 0 0 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="205.112.6.216" src_port="80"/>
            <filter dst_ip="205.112.6.216" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.080780,1.962290,503,0 0 0 1 1 1 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter src_ip="97.214.196.54" dst_ip="205.112.234.11" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.590350,2.068640,503,1 1 0 1 1 0 1 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="205.125.232.206" dst_port="80"/>
            <filter src_ip="205.125.232.206" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.226980,2.208630,999,0 0 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="204.122.95.87" src_port="123"/>
            <filter dst_ip="204.122.95.87" dst_port="123"/>
            <filter src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1381381201"/>
        <to usec="0" sec="1381382102"/>
    </anomaly>
    <anomaly type="anomalous" value="1.962520,1.868460,503,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="25.182.79.99" dst_ip="175.204.4.179"/>
            <filter src_ip="25.182.79.99" src_port="80"/>
            <filter dst_ip="175.204.4.179" src_port="80"/>
            <filter src_ip="196.19.211.184" dst_ip="175.204.4.179" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.686710,2.089590,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="195.232.118.240" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.309200,1.990170,503,0 0 0 1 1 1 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.101.192.41" dst_ip="81.69.167.68" src_port="80"/>
            <filter src_ip="169.101.192.41" dst_ip="196.19.219.39" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.497530,2.369520,503,1 1 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="204.122.89.235" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.007860,1.852340,503,0 0 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="150.140.100.228" src_port="80"/>
            <filter src_ip="150.140.100.157" src_port="80"/>
            <filter dst_ip="136.120.89.81" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.720010,2.075190,503,0 0 0 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="205.112.4.101" src_port="80"/>
            <filter dst_ip="205.112.4.101" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.686710,2.089590,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter src_ip="150.140.100.74" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.997910,1.887400,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="169.101.89.160" src_port="443"/>
            <filter src_ip="126.112.103.160" dst_ip="169.101.89.160" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.997910,1.887400,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="205.112.4.101" dst_ip="191.91.185.107" src_port="60384" dst_port="80"/>
            <filter src_ip="205.112.4.101" dst_ip="191.91.185.107" src_port="51299" dst_port="80"/>
            <filter src_ip="205.112.4.101" dst_ip="191.91.185.107" src_port="39541" dst_port="80"/>
            <filter src_ip="205.112.4.101" dst_ip="191.91.185.107" src_port="33355" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.997910,1.887400,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="136.120.90.13" src_port="80"/>
            <filter dst_ip="136.120.90.13" dst_port="35476"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.609200,3.075280,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="222.136.66.192" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.997910,1.887400,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="136.120.141.129" src_port="80"/>
            <filter dst_ip="136.120.141.129" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.962520,1.868460,504,0 0 0 1 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="205.112.6.216" dst_port="80"/>
            <filter src_ip="205.112.6.216" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.182760,1.867320,999,0 0 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="66.227.34.40" dst_port="53"/>
            <filter dst_ip="169.118.197.222" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.628350,1.941610,999,1 0 0 0 0 0 0 0 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="204.122.89.156" dst_ip="176.174.192.54"/>
        </slice>
        <from usec="0" sec="1381381728"/>
        <to usec="0" sec="1381381730"/>
    </anomaly>
    <anomaly type="suspicious" value="1.628350,1.941610,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="2.101.195.180" dst_port="139" proto="tcp"/>
        </slice>
        <from usec="0" sec="1381381696"/>
        <to usec="0" sec="1381381734"/>
    </anomaly>
    <anomaly type="suspicious" value="1.687070,1.960410,010,0 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="2.101.195.180" dst_port="445" proto="tcp"/>
        </slice>
        <from usec="0" sec="1381381696"/>
        <to usec="0" sec="1381381734"/>
    </anomaly>
    <anomaly type="suspicious" value="1.695800,2.000480,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1381381201"/>
        <to usec="0" sec="1381382029"/>
    </anomaly>
    <anomaly type="suspicious" value="1.302170,1.740990,504,0 0 0 1 1 0 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="131.23.144.68" dst_port="443"/>
            <filter dst_ip="131.23.144.68" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.089670,2.212120,999,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="117.41.194.6" dst_port="53"/>
            <filter dst_ip="175.204.37.50" dst_port="53"/>
            <filter dst_ip="175.204.130.246" dst_port="53"/>
            <filter dst_ip="175.204.87.101" dst_port="53"/>
        </slice>
        <from usec="0" sec="1381381201"/>
        <to usec="0" sec="1381382102"/>
    </anomaly>
    <anomaly type="suspicious" value="2.089670,2.212120,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="91.84.102.169" dst_ip="175.204.87.101" dst_port="53"/>
        </slice>
        <from usec="0" sec="1381381201"/>
        <to usec="0" sec="1381381247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.409020,1.919520,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="91.84.102.169" dst_ip="175.204.37.50" dst_port="53"/>
        </slice>
        <from usec="0" sec="1381381201"/>
        <to usec="0" sec="1381381247"/>
    </anomaly>
    <anomaly type="suspicious" value="2.089670,2.212120,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="91.84.102.169" dst_ip="175.204.130.246" dst_port="53"/>
        </slice>
        <from usec="0" sec="1381381201"/>
        <to usec="0" sec="1381381247"/>
    </anomaly>
    <anomaly type="suspicious" value="2.089670,2.212120,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="131.146.6.251" dst_ip="175.204.87.101" dst_port="53"/>
        </slice>
        <from usec="0" sec="1381381201"/>
        <to usec="0" sec="1381381247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.409020,1.919520,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="131.146.6.251" dst_ip="175.204.37.50" dst_port="53"/>
        </slice>
        <from usec="0" sec="1381381201"/>
        <to usec="0" sec="1381381247"/>
    </anomaly>
    <anomaly type="suspicious" value="2.089670,2.212120,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="131.146.6.251" dst_ip="175.204.130.246" dst_port="53"/>
        </slice>
        <from usec="0" sec="1381381201"/>
        <to usec="0" sec="1381381247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.409020,1.919520,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="169.101.21.145" src_port="21158"/>
        </slice>
        <from usec="0" sec="1381381201"/>
        <to usec="0" sec="1381381247"/>
    </anomaly>
    <anomaly type="suspicious" value="2.089670,2.212120,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="2.57.238.207" dst_ip="175.204.87.101" dst_port="53"/>
        </slice>
        <from usec="0" sec="1381381201"/>
        <to usec="0" sec="1381381247"/>
    </anomaly>
    <anomaly type="suspicious" value="2.089670,2.212120,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="2.57.238.207" dst_ip="175.204.130.246" dst_port="53"/>
        </slice>
        <from usec="0" sec="1381381201"/>
        <to usec="0" sec="1381381247"/>
    </anomaly>
    <anomaly type="suspicious" value="2.089670,2.212120,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="83.206.143.195" dst_ip="175.204.87.101" dst_port="53"/>
        </slice>
        <from usec="0" sec="1381381201"/>
        <to usec="0" sec="1381381247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.409020,1.919520,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="83.206.143.195" dst_ip="175.204.37.50" dst_port="53"/>
        </slice>
        <from usec="0" sec="1381381201"/>
        <to usec="0" sec="1381381247"/>
    </anomaly>
    <anomaly type="suspicious" value="2.089670,2.212120,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="83.206.143.195" dst_ip="175.204.130.246" dst_port="53"/>
        </slice>
        <from usec="0" sec="1381381201"/>
        <to usec="0" sec="1381381247"/>
    </anomaly>
    <anomaly type="suspicious" value="2.089670,2.212120,010,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="4935" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1381381696"/>
        <to usec="0" sec="1381381742"/>
    </anomaly>
    <anomaly type="suspicious" value="1.358370,1.900900,010,0 0 0 1 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="100.156.173.130" dst_ip="169.156.157.89"/>
        </slice>
        <from usec="0" sec="1381381201"/>
        <to usec="0" sec="1381381787"/>
    </anomaly>
    <anomaly type="suspicious" value="1.409020,1.919520,999,0 0 0 0 0 0 1 1 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="97.253.6.2" dst_ip="175.204.130.246" dst_port="53"/>
            <filter src_ip="97.253.6.2" dst_ip="175.204.37.50" dst_port="53"/>
            <filter src_ip="97.253.6.2" dst_ip="175.204.87.101" dst_port="53"/>
        </slice>
        <from usec="0" sec="1381381966"/>
        <to usec="0" sec="1381382012"/>
    </anomaly>
    <anomaly type="suspicious" value="1.401960,1.756560,503,0 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="175.204.129.184" src_port="80"/>
            <filter dst_ip="175.204.129.184" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.451090,1.776690,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="169.101.209.150" src_port="80"/>
            <filter src_ip="178.91.113.108" dst_ip="169.101.209.150" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.642680,1.772350,503,0 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="150.140.100.251" src_port="80"/>
            <filter dst_ip="136.120.14.90" src_port="80"/>
            <filter dst_ip="136.120.178.184" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.451090,1.776690,999,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="205.125.241.175" src_port="80"/>
            <filter dst_ip="205.125.241.175" src_port="443"/>
            <filter src_ip="107.145.166.231" dst_ip="205.125.241.175" src_port="9418"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.451090,1.776690,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="74.123.209.199" dst_ip="175.204.211.102" src_port="80"/>
            <filter src_ip="74.123.209.199" dst_ip="169.118.197.221" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.451090,1.776690,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="169.101.23.151" dst_ip="131.23.162.130" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.451090,1.776690,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="169.101.32.146" dst_ip="178.91.98.43" src_port="80" dst_port="55719"/>
            <filter src_ip="169.101.32.146" dst_ip="178.91.98.43" src_port="80" dst_port="53986"/>
            <filter src_ip="175.204.241.171" dst_ip="178.91.98.43" src_port="80" dst_port="47685"/>
            <filter src_ip="175.204.217.22" dst_ip="178.91.98.43" src_port="80" dst_port="53829"/>
            <filter src_ip="175.204.219.98" dst_ip="178.91.98.43" src_port="80" dst_port="55618"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.451090,1.776690,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="136.120.90.34" src_port="443"/>
            <filter dst_ip="136.120.90.34" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
