<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.775690,1.538220,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="214.213.113.229" src_port="6000" dst_port="22"/>
        </slice>
        <from usec="0" sec="1386825205"/>
        <to usec="0" sec="1386825207"/>
    </anomaly>
    <anomaly type="anomalous" value="2.543500,1.746740,010,1 1 1 1 1 1 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="97.138.188.149" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.775690,1.538220,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="79.238.240.93" dst_port="22"/>
        </slice>
        <from usec="0" sec="1386824467"/>
        <to usec="0" sec="1386824966"/>
    </anomaly>
    <anomaly type="anomalous" value="2.557780,1.762790,010,1 1 1 1 1 1 1 1 1 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="11.193.130.33" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.207920,1.643030,020,1 1 1 0 0 0 1 1 1 1 1 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="97.138.188.149"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.758840,1.517020,010,1 1 0 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="209.194.0.183" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1386825075"/>
        <to usec="0" sec="1386825121"/>
    </anomaly>
    <anomaly type="anomalous" value="1.775690,1.538220,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="178.231.35.88" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1386825240"/>
        <to usec="0" sec="1386825241"/>
    </anomaly>
    <anomaly type="anomalous" value="1.806950,1.508210,011,1 1 1 0 0 0 0 0 0 1 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="11.193.130.33" src_port="1433" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.450880,1.721190,503,1 1 1 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="157.53.125.34" src_port="443"/>
            <filter dst_ip="157.53.125.34" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.517680,1.302570,503,0 0 0 1 1 1 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="157.47.45.240" dst_ip="205.49.8.13" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.740280,1.413080,504,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="66.107.62.4" dst_ip="197.42.56.52" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.357260,1.344730,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="157.47.129.196" dst_port="80"/>
            <filter src_ip="157.47.129.196" dst_ip="15.39.17.177" dst_port="443"/>
        </slice>
        <from usec="0" sec="1386824405"/>
        <to usec="0" sec="1386825227"/>
    </anomaly>
    <anomaly type="anomalous" value="1.357260,1.344730,504,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="157.47.188.150" dst_ip="53.97.114.112" dst_port="443"/>
            <filter src_ip="157.47.188.150" dst_ip="53.97.114.112" dst_port="80"/>
        </slice>
        <from usec="0" sec="1386824410"/>
        <to usec="0" sec="1386825214"/>
    </anomaly>
    <anomaly type="anomalous" value="1.350490,1.295190,503,0 0 0 0 0 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="196.32.41.64" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.127370,1.649160,999,1 1 1 0 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="105.135.211.106" dst_port="53"/>
            <filter src_ip="91.20.136.182" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.740280,1.413080,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="101.12.126.204" src_port="80"/>
            <filter dst_ip="162.1.204.147" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.740280,1.413080,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="162.1.96.81" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.740280,1.413080,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="190.222.242.245" src_port="80"/>
            <filter src_ip="190.222.242.155" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.740280,1.413080,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="190.222.242.154" src_port="80"/>
            <filter dst_ip="162.1.24.176" src_port="80"/>
            <filter dst_ip="162.1.24.176" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.348520,1.220590,504,1 0 0 1 0 0 1 1 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="153.95.10.136" dst_port="443"/>
            <filter src_ip="153.95.10.136" dst_port="80"/>
            <filter src_ip="153.95.45.101" dst_port="443"/>
            <filter src_ip="153.95.45.101" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.927570,1.498690,503,1 1 1 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="197.32.47.153" dst_port="80"/>
            <filter src_ip="197.32.47.153" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.071040,1.562630,504,0 0 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter dst_ip="197.32.8.127" src_port="80"/>
            <filter dst_ip="197.42.62.230" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.777810,1.418330,504,0 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="84.224.205.164" dst_ip="153.95.10.136"/>
            <filter src_ip="84.224.205.164" src_port="443"/>
            <filter dst_ip="153.95.10.136" src_port="80"/>
            <filter dst_ip="153.95.10.136" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.448060,1.312730,503,0 0 0 1 1 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="196.32.41.64" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.890778,1.233410,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="196.32.42.163" dst_ip="128.139.33.16" src_port="65239" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1386825205"/>
        <to usec="0" sec="1386825207"/>
    </anomaly>
    <anomaly type="suspicious" value="0.890778,1.233410,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="162.1.180.49" dst_ip="218.116.212.139" src_port="53042" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1386825205"/>
        <to usec="0" sec="1386825207"/>
    </anomaly>
    <anomaly type="suspicious" value="0.890778,1.233410,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="197.42.152.14" dst_ip="25.12.71.187" src_port="50253" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1386825205"/>
        <to usec="0" sec="1386825207"/>
    </anomaly>
    <anomaly type="suspicious" value="1.353830,1.362470,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.199.17.115" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1386824737"/>
        <to usec="0" sec="1386824747"/>
    </anomaly>
    <anomaly type="suspicious" value="1.353830,1.362470,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="78.0.164.50" dst_port="445"/>
            <filter src_ip="78.0.164.50" dst_port="139"/>
        </slice>
        <from usec="0" sec="1386824527"/>
        <to usec="0" sec="1386824568"/>
    </anomaly>
    <anomaly type="suspicious" value="0.899557,1.242260,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1386824400"/>
        <to usec="0" sec="1386825228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954174,1.238850,502,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="196.32.44.8"/>
        </slice>
        <from usec="0" sec="1386824402"/>
        <to usec="0" sec="1386824688"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954174,1.238850,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="162.1.192.161" dst_ip="159.82.144.98" dst_port="443"/>
        </slice>
        <from usec="0" sec="1386824437"/>
        <to usec="0" sec="1386824640"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954174,1.238850,999,0 0 0 1 1 0 0 0 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="197.167.11.31" dst_ip="192.168.1.251" src_port="53"/>
        </slice>
        <from usec="0" sec="1386824403"/>
        <to usec="0" sec="1386824778"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954174,1.238850,504,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="59.88.85.31" dst_ip="162.1.110.65" src_port="443"/>
        </slice>
        <from usec="0" sec="1386824408"/>
        <to usec="0" sec="1386824739"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954174,1.238850,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="162.1.22.142" dst_ip="91.214.158.47" dst_port="80"/>
        </slice>
        <from usec="0" sec="1386824644"/>
        <to usec="0" sec="1386824777"/>
    </anomaly>
    <anomaly type="suspicious" value="1.011160,1.201380,503,0 0 0 1 1 0 0 0 0 1 0 0,salphfl">
        <slice>
            <filter src_ip="178.19.16.20" dst_ip="162.1.182.232" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.051920,1.293820,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1386824400"/>
        <to usec="0" sec="1386825228"/>
    </anomaly>
    <anomaly type="suspicious" value="1.198120,1.358470,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="197.167.11.31" src_port="53" dst_port="1001"/>
        </slice>
        <from usec="0" sec="1386824535"/>
        <to usec="0" sec="1386825121"/>
    </anomaly>
    <anomaly type="suspicious" value="0.962054,1.239420,503,1 0 0 0 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="11.99.252.242" dst_ip="197.42.133.120" dst_port="80"/>
        </slice>
        <from usec="0" sec="1386825120"/>
        <to usec="0" sec="1386825207"/>
    </anomaly>
    <anomaly type="suspicious" value="1.198120,1.358470,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="196.32.40.27" dst_port="53"/>
        </slice>
        <from usec="0" sec="1386824535"/>
        <to usec="0" sec="1386824581"/>
    </anomaly>
    <anomaly type="suspicious" value="1.198120,1.358470,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="196.32.40.27" dst_port="80"/>
        </slice>
        <from usec="0" sec="1386824535"/>
        <to usec="0" sec="1386824581"/>
    </anomaly>
    <anomaly type="suspicious" value="1.198120,1.358470,503,0 0 0 0 0 0 1 1 1 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="98.229.150.166" dst_ip="196.32.40.26" dst_port="80"/>
            <filter src_ip="11.99.252.242" dst_ip="196.32.40.26" dst_port="80"/>
        </slice>
        <from usec="0" sec="1386824535"/>
        <to usec="0" sec="1386824581"/>
    </anomaly>
    <anomaly type="suspicious" value="1.198120,1.358470,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="157.47.46.202" dst_port="53"/>
        </slice>
        <from usec="0" sec="1386824535"/>
        <to usec="0" sec="1386824581"/>
    </anomaly>
    <anomaly type="suspicious" value="1.198120,1.358470,503,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="11.99.252.242" dst_ip="196.32.36.181" dst_port="80"/>
        </slice>
        <from usec="0" sec="1386824400"/>
        <to usec="0" sec="1386824581"/>
    </anomaly>
    <anomaly type="suspicious" value="1.239650,1.355360,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="196.32.38.196" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1386824400"/>
        <to usec="0" sec="1386825121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.198120,1.358470,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="197.42.133.120" dst_port="53"/>
        </slice>
        <from usec="0" sec="1386824535"/>
        <to usec="0" sec="1386824581"/>
    </anomaly>
    <anomaly type="suspicious" value="1.198120,1.358470,503,0 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="98.196.115.3" dst_ip="197.42.133.120" dst_port="80"/>
        </slice>
        <from usec="0" sec="1386824535"/>
        <to usec="0" sec="1386824581"/>
    </anomaly>
    <anomaly type="suspicious" value="0.986362,1.325460,901,0 0 0 0 0 0 0 0 1 0 0 0,empty">
        <slice/>
        <from usec="0" sec="1386825075"/>
        <to usec="0" sec="1386825121"/>
    </anomaly>
    <anomaly type="suspicious" value="0.986362,1.325460,010,0 0 0 0 0 0 0 0 1 0 0 0,mptmp">
        <slice>
            <filter src_port="4935" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1386825075"/>
        <to usec="0" sec="1386825121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.120120,1.187300,504,1 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="162.1.24.110" dst_port="443"/>
            <filter src_ip="162.1.24.110" dst_ip="204.216.93.190" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095370,1.170030,504,0 0 0 1 0 0 1 1 0 1 1 0,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter src_ip="197.32.8.127" dst_port="80"/>
            <filter src_ip="197.42.62.230" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.209330,1.257170,503,0 0 0 1 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="101.12.97.138" dst_ip="153.95.240.72" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.951563,1.195770,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="205.49.8.13" dst_ip="157.47.45.240" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.120120,1.187300,503,1 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="196.32.32.87" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797510,1.135260,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="162.1.58.57" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166720,1.260520,502,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="153.69.26.99" src_port="22"/>
            <filter src_ip="153.69.26.99" dst_ip="153.95.212.85" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797510,1.135260,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="157.47.243.75" dst_ip="119.157.33.201" dst_port="443"/>
            <filter src_ip="157.47.243.75" dst_ip="119.157.34.86" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166720,1.260520,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="122.130.26.59" dst_ip="153.95.240.149" src_port="80" dst_port="64095"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797510,1.135260,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="153.95.45.26" src_port="80"/>
            <filter src_ip="84.224.205.164" dst_ip="153.95.45.26" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797510,1.135260,503,0 0 0 0 0 0 0 0 0 1 1 0,point_to_point">
        <slice>
            <filter src_ip="80.138.44.70" dst_ip="157.166.124.179" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166720,1.260520,503,0 0 0 0 0 0 0 0 0 1 1 1,malphfl">
        <slice>
            <filter src_ip="80.28.214.28" dst_ip="157.154.141.188" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166720,1.260520,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="157.154.226.224" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797510,1.135260,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="157.154.201.162" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166720,1.260520,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="153.95.45.101" src_port="80"/>
            <filter src_ip="110.164.165.70" dst_ip="157.53.125.32" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797510,1.135260,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="162.1.251.102" src_port="443"/>
            <filter src_ip="192.66.130.90" dst_ip="162.1.251.102" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797510,1.135260,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="162.1.192.205" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166720,1.260520,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="162.1.206.21" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166720,1.260520,503,0 0 0 0 0 0 0 0 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="101.12.126.176" dst_ip="162.1.112.69" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166720,1.260520,999,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="157.47.244.54" src_port="6881"/>
            <filter src_ip="157.47.244.54" dst_port="80"/>
            <filter src_ip="157.47.244.54" dst_port="6881"/>
            <filter src_port="6881" dst_port="6881"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797510,1.135260,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="214.244.238.244" dst_ip="197.42.152.203" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797510,1.135260,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="197.42.146.16" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797510,1.135260,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="32.170.248.231" dst_ip="153.95.66.103" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
