<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="2.338290,2.183220,504,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="198.145.246.245" dst_ip="85.116.215.64" src_port="52672" dst_port="443"/>
        </slice>
        <from usec="0" sec="1384146027"/>
        <to usec="0" sec="1384146727"/>
    </anomaly>
    <anomaly type="anomalous" value="2.338290,2.183220,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="150.208.78.141" dst_ip="208.5.183.246" src_port="50410" dst_port="80"/>
            <filter src_ip="150.208.78.141" dst_ip="208.5.183.246" src_port="50409" dst_port="80"/>
            <filter src_ip="150.208.78.141" dst_ip="61.64.101.6" src_port="49269" dst_port="80"/>
            <filter src_ip="150.208.78.141" dst_ip="175.76.156.210" src_port="50445" dst_port="80"/>
        </slice>
        <from usec="0" sec="1384146227"/>
        <to usec="0" sec="1384146229"/>
    </anomaly>
    <anomaly type="anomalous" value="2.487830,2.185250,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="103.110.170.166" src_port="5069" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1384146000"/>
        <to usec="0" sec="1384146047"/>
    </anomaly>
    <anomaly type="anomalous" value="2.338290,2.183220,504,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="165.226.107.64" dst_ip="85.85.231.131" src_port="52722" dst_port="443"/>
        </slice>
        <from usec="0" sec="1384146535"/>
        <to usec="0" sec="1384146728"/>
    </anomaly>
    <anomaly type="anomalous" value="2.338290,2.183220,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="150.208.76.15" dst_ip="208.5.183.97" dst_port="80"/>
            <filter src_ip="150.208.76.15" dst_ip="208.5.183.124" dst_port="80"/>
        </slice>
        <from usec="0" sec="1384146117"/>
        <to usec="0" sec="1384146122"/>
    </anomaly>
    <anomaly type="anomalous" value="3.755120,2.545980,503,1 1 1 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="165.61.132.87" dst_ip="54.186.50.50" src_port="80"/>
            <filter src_ip="165.61.132.87" dst_ip="205.170.193.208" src_port="80"/>
            <filter src_ip="165.61.132.87" dst_ip="6.5.31.45" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.755120,2.545980,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="38.137.40.143" dst_port="6670"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.870010,2.171100,010,1 1 1 0 0 0 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="97.2.46.46" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.247710,2.107500,011,1 1 1 1 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="35.217.0.34" src_port="1433" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1384146000"/>
        <to usec="0" sec="1384146819"/>
    </anomaly>
    <anomaly type="anomalous" value="2.338290,2.183220,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="62.216.239.150"/>
        </slice>
        <from usec="0" sec="1384146409"/>
        <to usec="0" sec="1384146411"/>
    </anomaly>
    <anomaly type="anomalous" value="2.351830,2.081240,999,1 1 1 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="199.7.150.11" dst_port="3027"/>
            <filter dst_ip="199.7.150.11" dst_port="666"/>
        </slice>
        <from usec="0" sec="1384146000"/>
        <to usec="0" sec="1384146825"/>
    </anomaly>
    <anomaly type="anomalous" value="3.360330,2.261120,503,1 1 1 1 1 0 1 1 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="199.10.44.41" dst_port="80"/>
            <filter src_ip="199.10.44.41" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.706430,2.070660,010,1 0 0 1 1 1 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="199.162.69.78" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.883270,2.036780,503,1 1 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="198.145.244.227" src_port="80"/>
            <filter src_ip="198.145.253.76" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.557930,2.318050,999,0 0 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="198.145.250.199" src_port="123"/>
            <filter dst_ip="198.145.250.199" dst_port="123"/>
            <filter src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1384146000"/>
        <to usec="0" sec="1384146901"/>
    </anomaly>
    <anomaly type="anomalous" value="3.391510,2.365670,010,1 1 1 1 1 1 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="194.1.208.73" src_port="31863" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.201090,2.058710,504,0 0 0 1 1 1 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="160.154.168.139" dst_ip="109.11.19.85" src_port="55813" dst_port="443"/>
            <filter src_ip="160.154.168.139" dst_ip="109.11.19.85" src_port="55812" dst_port="443"/>
            <filter src_ip="160.154.168.139" dst_ip="109.11.19.85" src_port="55811" dst_port="443"/>
            <filter src_ip="160.154.168.139" dst_ip="109.11.19.85" src_port="55810" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.003680,2.070670,010,1 1 1 1 1 0 1 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="135.8.7.25" dst_port="8888"/>
            <filter src_ip="135.8.7.25" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.422100,2.368310,504,1 1 0 1 1 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter dst_ip="203.201.35.157" src_port="3389"/>
            <filter src_ip="199.7.141.84" dst_ip="6.160.181.43" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.557930,2.318050,503,0 0 0 1 1 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="199.7.132.121" src_port="80"/>
        </slice>
        <from usec="0" sec="1384146000"/>
        <to usec="0" sec="1384146828"/>
    </anomaly>
    <anomaly type="anomalous" value="2.990230,2.379420,999,1 1 0 1 1 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="202.241.0.90" dst_ip="198.145.250.191" dst_port="19"/>
        </slice>
        <from usec="0" sec="1384146000"/>
        <to usec="0" sec="1384146901"/>
    </anomaly>
    <anomaly type="anomalous" value="2.247710,2.107500,010,1 1 1 1 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="151.86.14.96" dst_port="80"/>
        </slice>
        <from usec="0" sec="1384146237"/>
        <to usec="0" sec="1384146548"/>
    </anomaly>
    <anomaly type="anomalous" value="2.557930,2.318050,999,0 0 0 1 1 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="199.145.167.219" src_port="53"/>
        </slice>
        <from usec="0" sec="1384146000"/>
        <to usec="0" sec="1384146901"/>
    </anomaly>
    <anomaly type="anomalous" value="3.051610,2.306640,503,0 0 0 1 1 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter dst_ip="199.7.132.121"/>
            <filter dst_ip="198.145.245.24"/>
            <filter dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.557930,2.318050,503,0 0 0 1 1 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="165.33.142.128" src_port="80"/>
        </slice>
        <from usec="0" sec="1384146121"/>
        <to usec="0" sec="1384146600"/>
    </anomaly>
    <anomaly type="anomalous" value="2.545490,2.410030,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="148.38.40.173" src_port="53"/>
        </slice>
        <from usec="0" sec="1384146225"/>
        <to usec="0" sec="1384146271"/>
    </anomaly>
    <anomaly type="anomalous" value="2.545490,2.410030,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="165.61.3.224" src_port="53"/>
        </slice>
        <from usec="0" sec="1384146225"/>
        <to usec="0" sec="1384146271"/>
    </anomaly>
    <anomaly type="anomalous" value="2.545490,2.410030,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="199.145.167.219" dst_ip="10.20.8.35" src_port="53"/>
        </slice>
        <from usec="0" sec="1384146225"/>
        <to usec="0" sec="1384146271"/>
    </anomaly>
    <anomaly type="anomalous" value="2.462530,2.341660,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="198.145.252.112" src_port="53"/>
            <filter dst_ip="198.145.252.112" dst_port="53"/>
        </slice>
        <from usec="0" sec="1384146000"/>
        <to usec="0" sec="1384146468"/>
    </anomaly>
    <anomaly type="anomalous" value="2.675810,2.318780,999,0 0 0 1 0 0 1 1 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="198.145.252.118" dst_port="53"/>
            <filter dst_ip="165.61.202.144" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.989900,2.742120,503,1 0 0 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="198.145.253.76" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.462530,2.341660,999,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="199.7.129.73" dst_ip="151.86.79.129"/>
            <filter src_ip="199.7.129.73" src_port="53"/>
            <filter dst_ip="151.86.79.129" src_port="53"/>
            <filter dst_ip="136.236.229.244" src_port="53"/>
        </slice>
        <from usec="0" sec="1384146000"/>
        <to usec="0" sec="1384146738"/>
    </anomaly>
    <anomaly type="anomalous" value="2.557930,2.318050,999,0 0 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="34.167.22.123" src_port="53"/>
            <filter dst_ip="150.208.174.129" src_port="53"/>
        </slice>
        <from usec="0" sec="1384146000"/>
        <to usec="0" sec="1384146901"/>
    </anomaly>
    <anomaly type="anomalous" value="2.557930,2.318050,999,0 0 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="1.79.157.67" dst_ip="160.154.85.177"/>
            <filter src_ip="1.79.157.67" dst_port="53"/>
            <filter dst_ip="160.154.85.177" dst_port="53"/>
            <filter dst_ip="160.154.222.42" dst_port="53"/>
        </slice>
        <from usec="0" sec="1384146000"/>
        <to usec="0" sec="1384146901"/>
    </anomaly>
    <anomaly type="anomalous" value="1.908890,1.755010,504,1 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="165.61.85.63" dst_ip="61.64.98.17" dst_port="443"/>
            <filter src_ip="160.154.194.149" dst_ip="59.102.36.6" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.019400,2.275470,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter dst_ip="199.7.139.134" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.479680,2.451870,503,0 0 0 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="165.43.225.138" src_port="80"/>
            <filter dst_ip="165.43.225.138" src_port="443"/>
            <filter src_ip="46.37.154.200" dst_ip="165.43.225.136" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.248170,2.356140,010,1 1 1 1 1 1 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="62.216.239.150" src_port="12200" dst_port="21320"/>
            <filter src_ip="62.216.239.150" src_port="12200" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.418950,2.072460,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="26.123.110.129" dst_ip="150.208.73.105" src_port="80"/>
            <filter src_ip="201.127.227.35" dst_ip="150.208.73.105" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.331500,1.992540,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="150.208.168.206" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.019400,2.275470,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="199.188.43.127" src_port="80"/>
            <filter dst_ip="199.7.150.158" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.418950,2.072460,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="150.208.73.105" dst_ip="26.123.110.129" dst_port="80"/>
            <filter src_ip="150.208.73.105" dst_ip="201.127.227.35" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.592560,1.963580,504,1 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="160.154.180.196" dst_ip="154.4.125.34"/>
            <filter src_ip="160.154.180.196" dst_port="80"/>
            <filter src_ip="160.154.180.196" dst_port="443"/>
            <filter src_ip="160.154.136.193" dst_port="80"/>
            <filter dst_ip="154.4.125.34" dst_port="80"/>
            <filter dst_ip="154.4.125.34" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.850010,2.547720,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="34.249.146.57" src_port="52694" dst_port="8080"/>
            <filter src_ip="35.217.7.157" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.408910,2.274480,010,1 1 1 1 1 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="35.217.0.34" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.796690,2.094950,503,1 1 1 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="160.154.118.108" dst_port="80"/>
            <filter dst_ip="61.64.100.53" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.418950,2.072460,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter dst_ip="150.208.37.164" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.418950,2.072460,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="208.5.167.120" dst_ip="199.7.153.173" src_port="80" dst_port="61594"/>
            <filter src_ip="208.5.167.120" dst_ip="199.7.153.173" src_port="80" dst_port="61053"/>
            <filter src_ip="208.5.167.120" dst_ip="199.7.153.173" src_port="80" dst_port="60470"/>
            <filter src_ip="208.5.167.120" dst_ip="199.7.139.170" src_port="80" dst_port="50479"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.451210,2.491220,503,0 0 0 1 1 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="160.154.160.177" src_port="80"/>
            <filter dst_ip="160.154.160.177" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.418950,2.072460,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="18.77.103.10" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.576140,1.966990,503,0 0 0 1 1 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="150.208.49.53" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.184640,2.795010,503,1 1 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="199.10.44.41" src_port="80"/>
            <filter dst_ip="199.10.44.41" src_port="443"/>
            <filter dst_ip="199.7.28.97" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.576140,1.966990,504,0 0 0 1 1 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="154.4.125.34" dst_port="443"/>
            <filter dst_ip="154.4.125.34" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.850010,2.547720,010,1 1 1 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="216.17.61.11" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.697620,1.936630,999,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="150.208.238.28" dst_ip="211.242.156.34" src_port="56279" dst_port="25"/>
        </slice>
        <from usec="0" sec="1384146031"/>
        <to usec="0" sec="1384146033"/>
    </anomaly>
    <anomaly type="suspicious" value="1.697620,1.936630,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="165.61.80.176" dst_ip="208.5.183.180" src_port="63134" dst_port="80"/>
            <filter src_ip="165.61.80.176" dst_ip="7.0.140.236" src_port="63791" dst_port="80"/>
        </slice>
        <from usec="0" sec="1384146065"/>
        <to usec="0" sec="1384146067"/>
    </anomaly>
    <anomaly type="suspicious" value="1.697620,1.936630,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="165.61.38.48" dst_ip="208.5.183.181" src_port="59478" dst_port="80"/>
            <filter src_ip="165.61.38.48" dst_ip="208.5.183.181" src_port="59477" dst_port="80"/>
        </slice>
        <from usec="0" sec="1384146214"/>
        <to usec="0" sec="1384146216"/>
    </anomaly>
    <anomaly type="suspicious" value="1.697620,1.936630,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="150.208.211.241" dst_ip="208.5.183.243" src_port="58639" dst_port="80"/>
            <filter src_ip="150.208.211.241" dst_ip="208.5.183.243" src_port="58638" dst_port="80"/>
        </slice>
        <from usec="0" sec="1384146031"/>
        <to usec="0" sec="1384146033"/>
    </anomaly>
    <anomaly type="suspicious" value="1.697620,1.936630,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="165.44.83.34" dst_ip="208.5.183.162" src_port="53201" dst_port="80"/>
            <filter src_ip="165.44.83.34" dst_ip="208.5.183.162" src_port="53198" dst_port="80"/>
        </slice>
        <from usec="0" sec="1384146219"/>
        <to usec="0" sec="1384146221"/>
    </anomaly>
    <anomaly type="suspicious" value="1.697620,1.936630,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="150.208.89.231" dst_ip="199.43.27.114" dst_port="80"/>
            <filter src_ip="150.208.89.231" dst_ip="199.11.26.95" dst_port="80"/>
        </slice>
        <from usec="0" sec="1384146598"/>
        <to usec="0" sec="1384146600"/>
    </anomaly>
    <anomaly type="suspicious" value="1.697620,1.936630,999,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="24.72.34.194" dst_ip="198.145.248.64" src_port="54448" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1384146605"/>
        <to usec="0" sec="1384146607"/>
    </anomaly>
    <anomaly type="suspicious" value="1.697620,1.936630,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="138.184.183.215" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1384146714"/>
        <to usec="0" sec="1384146718"/>
    </anomaly>
    <anomaly type="suspicious" value="1.640770,1.742140,504,1 0 0 1 0 0 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="165.61.70.77" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.163400,1.738620,504,1 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="199.7.24.124" dst_ip="61.64.98.251" dst_port="443"/>
            <filter src_ip="199.7.24.124" dst_ip="61.64.96.111" dst_port="443"/>
        </slice>
        <from usec="0" sec="1384146543"/>
        <to usec="0" sec="1384146828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.936210,2.084450,504,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="61.64.98.251" dst_ip="199.7.24.124" src_port="443"/>
            <filter src_ip="61.64.96.111" dst_ip="199.7.24.124" src_port="443"/>
        </slice>
        <from usec="0" sec="1384146543"/>
        <to usec="0" sec="1384146828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.936210,2.084450,504,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="61.64.100.39" src_port="80"/>
            <filter dst_ip="150.208.211.107" src_port="80"/>
            <filter dst_ip="150.208.211.107" src_port="443"/>
        </slice>
        <from usec="0" sec="1384146000"/>
        <to usec="0" sec="1384146827"/>
    </anomaly>
    <anomaly type="suspicious" value="1.716220,1.820890,503,1 1 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="199.10.5.101" dst_port="80"/>
        </slice>
        <from usec="0" sec="1384146000"/>
        <to usec="0" sec="1384146828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.919740,2.186280,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1384146000"/>
        <to usec="0" sec="1384146828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.864110,2.072700,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="165.61.186.229" dst_ip="141.225.78.113"/>
        </slice>
        <from usec="0" sec="1384146225"/>
        <to usec="0" sec="1384146271"/>
    </anomaly>
    <anomaly type="suspicious" value="1.864110,2.072700,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="198.145.247.2" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1384146225"/>
        <to usec="0" sec="1384146271"/>
    </anomaly>
    <anomaly type="suspicious" value="1.256730,1.831830,504,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="199.7.130.78"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.256730,1.831830,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="209.102.212.243"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.256730,1.831830,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="85.85.231.128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.256730,1.831830,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="85.85.231.131"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.256730,1.831830,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="109.11.11.169"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.864110,2.072700,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="216.17.60.200" dst_ip="160.154.160.175" src_port="80"/>
            <filter src_ip="7.1.184.195" dst_ip="160.154.160.175" src_port="443"/>
        </slice>
        <from usec="0" sec="1384146225"/>
        <to usec="0" sec="1384146271"/>
    </anomaly>
    <anomaly type="suspicious" value="1.256730,1.831830,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="36.18.220.193" dst_ip="160.154.90.187" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.256730,1.831830,504,0 0 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="202.53.176.254" dst_ip="160.154.118.107"/>
            <filter src_ip="202.53.176.254" src_port="443"/>
            <filter dst_ip="160.154.118.107" src_port="443"/>
            <filter dst_ip="160.154.118.107" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.256730,1.831830,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="165.226.33.16"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.256730,1.831830,999,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="177.71.80.176" dst_port="23921"/>
            <filter dst_ip="177.71.80.176" dst_port="16798"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.256730,1.831830,504,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="85.116.223.94"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.256730,1.831830,504,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="121.206.98.58"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.803550,1.846470,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="199.43.27.130" dst_ip="150.208.89.231" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.803550,1.846470,504,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="199.7.152.200" src_port="443"/>
            <filter src_ip="204.130.162.185" dst_ip="199.7.152.200" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
