<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.950000,2.146620,503,0 0 0 0 0 0 0 0 0 0 0 1,mptplaHTTP">
        <slice>
            <filter src_ip="203.109.194.188" dst_ip="211.182.8.206" src_port="80"/>
            <filter src_ip="203.109.203.42" dst_ip="211.182.8.206" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254310,1.676200,504,1 0 0 1 1 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="60.41.117.183" dst_port="443"/>
            <filter dst_ip="60.41.117.183" dst_port="80"/>
        </slice>
        <from usec="0" sec="1404709201"/>
        <to usec="0" sec="1404710100"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="147.153.200.182" dst_ip="76.19.142.128" dst_port="80"/>
        </slice>
        <from usec="0" sec="1404709340"/>
        <to usec="0" sec="1404709919"/>
    </anomaly>
    <anomaly type="suspicious" value="1.637580,1.679870,503,1 0 0 1 1 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.132.217.108" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.109.207.106" dst_port="80"/>
        </slice>
        <from usec="0" sec="1404709690"/>
        <to usec="0" sec="1404710080"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="55.243.66.5" dst_ip="147.153.80.128" dst_port="80"/>
        </slice>
        <from usec="0" sec="1404709239"/>
        <to usec="0" sec="1404709619"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="147.153.129.90" dst_ip="76.61.178.40" dst_port="443"/>
        </slice>
        <from usec="0" sec="1404709507"/>
        <to usec="0" sec="1404709538"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="147.153.151.134" dst_ip="196.40.157.99" dst_port="80"/>
        </slice>
        <from usec="0" sec="1404709744"/>
        <to usec="0" sec="1404710014"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="110.215.29.88" dst_ip="202.132.221.179" src_port="1935" dst_port="7944"/>
        </slice>
        <from usec="0" sec="1404709534"/>
        <to usec="0" sec="1404709626"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.16.209.83" dst_ip="14.18.201.196" dst_port="443"/>
        </slice>
        <from usec="0" sec="1404709208"/>
        <to usec="0" sec="1404709274"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="148.172.179.92" dst_ip="75.24.40.168" src_port="49637" dst_port="443"/>
        </slice>
        <from usec="0" sec="1404709731"/>
        <to usec="0" sec="1404709805"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="147.153.151.0" dst_ip="76.19.141.170" dst_port="443"/>
            <filter src_ip="147.153.151.0" dst_ip="104.13.106.18" dst_port="443"/>
        </slice>
        <from usec="0" sec="1404709468"/>
        <to usec="0" sec="1404709748"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="203.146.125.28" dst_ip="203.109.194.188" src_port="53364" dst_port="873"/>
        </slice>
        <from usec="0" sec="1404709212"/>
        <to usec="0" sec="1404710097"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="126.146.71.211" dst_ip="147.133.211.197" src_port="3027" dst_port="11926"/>
        </slice>
        <from usec="0" sec="1404709224"/>
        <to usec="0" sec="1404709271"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,504,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.16.109.62" src_port="50259"/>
            <filter src_ip="163.16.109.62" dst_port="443"/>
        </slice>
        <from usec="0" sec="1404710045"/>
        <to usec="0" sec="1404710099"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="197.221.186.89" dst_ip="148.172.182.190" src_port="1935" dst_port="60559"/>
        </slice>
        <from usec="0" sec="1404709857"/>
        <to usec="0" sec="1404709906"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,503,1 1 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="1.14.176.33" dst_ip="147.153.80.128" dst_port="80"/>
            <filter src_ip="196.28.30.27" dst_ip="147.153.80.128" dst_port="80"/>
            <filter src_ip="55.243.66.5" dst_ip="147.153.80.128" dst_port="80"/>
        </slice>
        <from usec="0" sec="1404709204"/>
        <to usec="0" sec="1404710096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="148.172.146.220" dst_port="80"/>
        </slice>
        <from usec="0" sec="1404709560"/>
        <to usec="0" sec="1404709796"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="30.7.16.7" dst_port="23"/>
        </slice>
        <from usec="0" sec="1404709791"/>
        <to usec="0" sec="1404709815"/>
    </anomaly>
    <anomaly type="suspicious" value="1.136900,1.634460,504,1 1 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="169.158.12.24" dst_port="443"/>
        </slice>
        <from usec="0" sec="1404709460"/>
        <to usec="0" sec="1404709965"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,999,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="147.153.228.82" dst_ip="8.218.99.171" src_port="54533" dst_port="25"/>
        </slice>
        <from usec="0" sec="1404709293"/>
        <to usec="0" sec="1404709295"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158660,1.666690,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.16.224.246" dst_port="993"/>
        </slice>
        <from usec="0" sec="1404709204"/>
        <to usec="0" sec="1404709859"/>
    </anomaly>
    <anomaly type="suspicious" value="1.677980,1.887040,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="202.132.13.91" dst_ip="202.132.13.91" dst_port="53" proto="udp"/>
        </slice>
        <from usec="0" sec="1404709201"/>
        <to usec="0" sec="1404710098"/>
    </anomaly>
    <anomaly type="suspicious" value="1.677980,1.887040,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="16.233.71.163" dst_ip="16.233.71.163" proto="udp"/>
        </slice>
        <from usec="0" sec="1404709290"/>
        <to usec="0" sec="1404710050"/>
    </anomaly>
    <anomaly type="suspicious" value="1.677980,1.887040,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="203.109.198.211" dst_ip="203.109.198.211" dst_port="53" proto="udp"/>
        </slice>
        <from usec="0" sec="1404709201"/>
        <to usec="0" sec="1404710098"/>
    </anomaly>
    <anomaly type="suspicious" value="1.677980,1.887040,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="16.233.71.143" dst_ip="16.233.71.143" proto="udp"/>
        </slice>
        <from usec="0" sec="1404709530"/>
        <to usec="0" sec="1404710095"/>
    </anomaly>
    <anomaly type="suspicious" value="1.706000,1.869360,011,1 0 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="21.149.193.141" src_port="1603" dst_port="50415"/>
        </slice>
        <from usec="0" sec="1404710073"/>
        <to usec="0" sec="1404710075"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254310,1.676200,503,1 0 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="202.132.222.39" src_port="80"/>
            <filter src_ip="110.194.86.40" dst_ip="202.132.221.179" src_port="80"/>
        </slice>
        <from usec="0" sec="1404709201"/>
        <to usec="0" sec="1404709939"/>
    </anomaly>
    <anomaly type="suspicious" value="1.622270,1.725830,504,1 1 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="169.158.12.24" dst_port="443"/>
            <filter dst_ip="59.146.18.0" src_port="22"/>
        </slice>
        <from usec="0" sec="1404709201"/>
        <to usec="0" sec="1404709939"/>
    </anomaly>
    <anomaly type="suspicious" value="1.549480,1.638240,504,1 1 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="148.172.228.218" dst_ip="14.19.213.57"/>
            <filter src_ip="148.172.229.32" dst_ip="14.19.213.57" dst_port="443"/>
            <filter src_ip="148.172.228.218" dst_ip="110.243.157.140" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.136900,1.634460,504,1 1 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.16.86.10" dst_port="443"/>
        </slice>
        <from usec="0" sec="1404709201"/>
        <to usec="0" sec="1404709922"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158640,1.585860,504,1 0 0 1 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="1.14.185.193" src_port="443"/>
            <filter src_ip="1.14.185.193" src_port="80"/>
            <filter src_ip="100.48.86.78" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420780,1.644990,999,0 0 0 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="148.172.121.88" dst_ip="194.9.172.38" src_port="60972" dst_port="4070"/>
            <filter src_ip="148.172.121.88" dst_ip="14.18.201.121" src_port="61570" dst_port="80"/>
            <filter src_ip="148.172.121.88" dst_ip="209.54.129.33" src_port="49167" dst_port="5938"/>
            <filter src_ip="148.172.1.39" dst_ip="194.9.172.38" src_port="63988" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420780,1.644990,503,0 0 0 1 1 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="147.153.80.128" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.215940,1.695890,503,0 0 0 1 1 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="141.52.20.182" src_port="80"/>
        </slice>
        <from usec="0" sec="1404709643"/>
        <to usec="0" sec="1404709827"/>
    </anomaly>
    <anomaly type="suspicious" value="2.348320,2.408650,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1404709201"/>
        <to usec="0" sec="1404709939"/>
    </anomaly>
    <anomaly type="suspicious" value="1.215940,1.695890,999,0 0 0 1 1 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.109.202.97"/>
        </slice>
        <from usec="0" sec="1404709201"/>
        <to usec="0" sec="1404709669"/>
    </anomaly>
    <anomaly type="suspicious" value="1.215940,1.695890,999,0 0 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="203.109.202.97"/>
            <filter dst_ip="203.109.194.206" src_port="53"/>
            <filter dst_ip="203.109.194.206"/>
        </slice>
        <from usec="0" sec="1404709201"/>
        <to usec="0" sec="1404710019"/>
    </anomaly>
    <anomaly type="suspicious" value="1.215940,1.695890,010,0 0 0 1 1 0 1 0 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="203.109.202.105" dst_port="80"/>
        </slice>
        <from usec="0" sec="1404709206"/>
        <to usec="0" sec="1404709811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.215940,1.695890,504,0 0 0 1 1 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="169.158.12.24" dst_port="443"/>
        </slice>
        <from usec="0" sec="1404709201"/>
        <to usec="0" sec="1404709902"/>
    </anomaly>
    <anomaly type="suspicious" value="1.347560,1.662470,503,0 0 0 1 0 0 1 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="48.137.114.130" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.215940,1.695890,999,0 0 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="203.109.200.18" dst_ip="202.57.76.8"/>
            <filter src_ip="203.109.200.18" dst_ip="202.57.78.40"/>
            <filter src_ip="203.109.200.18" dst_port="53"/>
            <filter dst_ip="202.57.76.8" dst_port="53"/>
            <filter dst_ip="202.57.78.40" dst_port="53"/>
        </slice>
        <from usec="0" sec="1404709201"/>
        <to usec="0" sec="1404709939"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254310,1.676200,504,1 0 0 1 1 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="60.41.114.93" dst_port="443"/>
            <filter dst_ip="60.41.114.93" dst_port="80"/>
        </slice>
        <from usec="0" sec="1404709651"/>
        <to usec="0" sec="1404710015"/>
    </anomaly>
    <anomaly type="suspicious" value="1.215940,1.695890,504,0 0 0 1 1 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="166.3.24.213" dst_ip="202.136.136.55" src_port="443"/>
        </slice>
        <from usec="0" sec="1404709201"/>
        <to usec="0" sec="1404710029"/>
    </anomaly>
    <anomaly type="suspicious" value="1.637580,1.679870,503,1 0 0 1 1 0 1 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="110.194.84.173" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.565530,1.670390,503,1 1 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="20.111.75.124" dst_ip="203.109.194.188" src_port="62801" dst_port="80"/>
            <filter src_ip="20.111.75.124" dst_ip="203.109.194.188" src_port="61159" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.139130,1.639440,504,0 0 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="147.41.145.173"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.139130,1.639440,999,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="114.195.1.216"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.139130,1.639440,999,0 0 0 0 0 0 0 0 0 1 0 0,ipv4gretun">
        <slice>
            <filter src_ip="204.51.86.136"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.139130,1.639440,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="110.49.218.204"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.139130,1.639440,503,0 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="147.41.145.68" src_port="80"/>
            <filter src_ip="154.209.127.33" dst_ip="147.41.145.68" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.453760,1.624670,503,1 0 0 1 1 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="147.153.230.14" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.180010,1.619060,504,1 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="188.155.138.42" dst_ip="141.52.142.8" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116990,1.606670,504,0 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="104.8.182.230" src_port="443"/>
            <filter dst_ip="163.16.200.210" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116990,1.606670,503,0 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="207.107.116.130" src_port="80"/>
            <filter src_ip="190.167.101.92" dst_ip="202.132.221.179" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420780,1.644990,503,0 0 0 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="1.14.185.224" src_port="80"/>
            <filter dst_ip="163.16.56.255" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116990,1.606670,503,0 0 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.16.249.152" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.139130,1.639440,504,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="202.132.223.64" src_port="443"/>
            <filter dst_ip="202.132.223.64" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158640,1.585860,503,1 0 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.109.194.188" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.139130,1.639440,999,0 0 0 0 0 0 0 0 0 1 0 0,ipv4gretun">
        <slice>
            <filter src_ip="203.109.194.50" dst_ip="204.51.86.136"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.637580,1.679870,999,1 0 0 1 1 0 1 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="163.16.32.62" src_port="25124"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.180010,1.619060,504,1 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="163.16.200.141" dst_ip="110.243.130.99" dst_port="443"/>
            <filter src_ip="163.16.57.209" dst_ip="110.243.130.99" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.180010,1.619060,504,1 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="202.136.160.168" dst_ip="75.19.209.150" src_port="63394" dst_port="443"/>
            <filter src_ip="202.136.160.168" dst_ip="75.19.209.150" src_port="63157" dst_port="443"/>
            <filter src_ip="202.136.160.168" dst_ip="75.19.209.150" src_port="62559" dst_port="443"/>
            <filter src_ip="202.136.160.168" dst_ip="75.19.209.150" src_port="60485" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.139130,1.639440,503,0 0 0 0 0 0 0 0 0 1 0 0,point_to_point">
        <slice>
            <filter src_ip="203.109.202.104" dst_ip="67.47.48.166" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.723120,1.692990,504,1 1 0 1 0 0 1 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="148.172.180.11" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.748150,2.810670,503,1 1 1 1 1 1 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="141.52.141.151" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.780980,1.675830,503,1 1 0 1 1 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="202.136.182.125" dst_port="80"/>
            <filter src_ip="202.136.182.125" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.134450,3.106450,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="27.133.203.66" src_port="33310" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.915000,2.436100,504,1 1 0 1 1 1 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="148.172.25.75" dst_ip="14.19.92.60"/>
            <filter src_ip="148.172.25.75" dst_port="443"/>
            <filter src_ip="148.172.25.75" dst_port="5938"/>
            <filter dst_ip="14.19.92.60" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.992200,1.913990,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.35.65.196" src_port="6000" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1404710046"/>
        <to usec="0" sec="1404710066"/>
    </anomaly>
    <anomaly type="anomalous" value="2.726540,2.138470,010,1 1 1 0 0 0 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="28.207.50.169" src_port="6000" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.202600,3.135670,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="29.202.101.54" src_port="6000" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.130050,1.961060,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.109.198.195" src_port="53"/>
        </slice>
        <from usec="0" sec="1404709207"/>
        <to usec="0" sec="1404710100"/>
    </anomaly>
    <anomaly type="anomalous" value="4.134450,3.106450,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="29.202.101.9" src_port="6000" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.855700,2.142730,011,1 1 1 1 1 0 0 0 0 1 1 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="8.57.64.145" src_port="8088" dst_port="6000"/>
            <filter dst_ip="214.15.152.147" src_port="1433" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.376020,1.964200,999,1 1 1 0 0 0 1 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.109.198.195" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.992200,1.913990,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="21.149.193.141" src_port="50415" dst_port="1603"/>
        </slice>
        <from usec="0" sec="1404710073"/>
        <to usec="0" sec="1404710075"/>
    </anomaly>
    <anomaly type="anomalous" value="2.130050,1.961060,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="24.35.166.53" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1404709651"/>
        <to usec="0" sec="1404709697"/>
    </anomaly>
    <anomaly type="anomalous" value="1.992200,1.913990,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="126.145.12.114" src_port="12200" dst_port="21320"/>
        </slice>
        <from usec="0" sec="1404709887"/>
        <to usec="0" sec="1404709889"/>
    </anomaly>
    <anomaly type="anomalous" value="1.992200,1.913990,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="190.181.49.252" dst_port="23"/>
        </slice>
        <from usec="0" sec="1404709815"/>
        <to usec="0" sec="1404709817"/>
    </anomaly>
    <anomaly type="anomalous" value="1.992200,1.913990,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="217.128.221.157" src_port="5064" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1404709530"/>
        <to usec="0" sec="1404709532"/>
    </anomaly>
    <anomaly type="anomalous" value="2.130050,1.961060,053,1 1 1 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="203.109.202.105" dst_port="80"/>
        </slice>
        <from usec="0" sec="1404709218"/>
        <to usec="0" sec="1404709815"/>
    </anomaly>
    <anomaly type="anomalous" value="4.202600,3.135670,010,1 1 1 1 1 1 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="177.192.205.85" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.723120,1.692990,503,1 1 0 1 0 0 1 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="202.136.136.55" dst_port="80"/>
            <filter src_ip="202.136.136.55" dst_port="443"/>
            <filter src_ip="202.132.221.179" dst_port="80"/>
            <filter src_ip="202.132.221.179" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.335210,2.611520,010,1 1 1 1 1 1 0 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="214.15.152.147" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.153360,2.772350,504,1 0 0 1 1 1 0 0 0 0 0 1,mptmp">
        <slice>
            <filter src_ip="48.104.76.65" src_port="443"/>
            <filter dst_ip="148.172.166.175" src_port="80"/>
            <filter dst_ip="148.172.166.175" src_port="443"/>
            <filter dst_ip="148.172.187.126" src_port="80"/>
            <filter dst_ip="148.172.187.126" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.608420,2.449940,999,0 0 0 1 1 1 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.132.13.91" dst_port="53"/>
        </slice>
        <from usec="0" sec="1404709201"/>
        <to usec="0" sec="1404710102"/>
    </anomaly>
    <anomaly type="anomalous" value="2.790330,2.365110,999,0 0 0 1 0 0 1 0 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.16.32.62" dst_port="25124"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.130050,1.961060,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.132.13.93" dst_port="53"/>
        </slice>
        <from usec="0" sec="1404709201"/>
        <to usec="0" sec="1404710102"/>
    </anomaly>
    <anomaly type="anomalous" value="2.065790,1.895990,503,1 0 0 1 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="148.172.135.166" src_port="80"/>
            <filter dst_ip="148.172.135.166" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.723120,1.692990,503,1 1 0 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="141.52.216.100" src_port="80"/>
            <filter dst_ip="141.52.248.85" src_port="80"/>
            <filter dst_ip="141.52.22.139" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="8.687730,7.770090,999,1 1 1 1 1 0 1 1 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="202.132.13.91" src_port="53"/>
            <filter src_ip="202.132.13.91" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.941380,2.377380,504,1 0 0 1 1 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="148.172.180.11" src_port="80"/>
            <filter dst_ip="148.172.180.11" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.807270,2.351030,504,1 0 0 1 0 0 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="28.197.176.104" src_port="443"/>
            <filter src_ip="28.197.176.104" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.923360,1.917090,503,1 1 0 0 0 0 0 0 0 0 1 0,alphflHTTP">
        <slice>
            <filter src_ip="193.135.7.229" dst_ip="202.132.221.179" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.042720,1.913420,503,0 0 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="163.16.122.124" src_port="80"/>
            <filter dst_ip="163.16.122.124" src_port="443"/>
            <filter dst_ip="148.172.134.119" src_port="80"/>
            <filter dst_ip="148.172.134.119" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.134450,3.106450,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="8.57.64.145" src_port="6000" dst_port="8088"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.936290,1.875830,503,1 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="24.64.8.38" dst_ip="203.109.194.188" src_port="63298" dst_port="80"/>
            <filter src_ip="24.64.8.38" dst_ip="203.109.194.188" src_port="62635" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.911660,1.893450,502,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="202.52.137.195" dst_port="22"/>
            <filter dst_ip="202.132.223.96" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.695860,2.348980,999,0 0 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="203.109.199.125" src_port="61963"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.911660,1.893450,999,0 0 0 0 0 0 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="85.163.162.45" dst_ip="203.109.205.140" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.648840,2.943140,999,0 0 0 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="203.109.205.140" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.686580,2.326230,503,0 0 0 1 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="214.43.250.20" dst_ip="141.52.21.174" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.695860,2.348980,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="197.165.254.148" dst_ip="141.52.53.186" src_port="80"/>
            <filter src_ip="39.50.168.48" dst_ip="141.52.53.186" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.748150,2.810670,010,1 1 1 1 1 1 1 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="64.147.183.43" src_port="6000" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.911660,1.893450,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.132.16.100" src_port="443"/>
            <filter dst_ip="202.132.16.100" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.307800,1.940000,503,1 1 0 1 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.109.203.42" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.471710,2.323570,999,0 0 0 1 0 0 0 0 0 0 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.109.194.50" dst_ip="206.169.119.13"/>
            <filter src_ip="203.109.194.50" dst_ip="204.51.86.136"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.901880,2.370680,503,1 1 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.109.194.188" src_port="80"/>
            <filter src_ip="203.109.203.42" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.695860,2.348980,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="147.41.145.68" src_port="443"/>
            <filter dst_ip="147.41.145.68" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.695860,2.348980,504,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="100.200.2.206" dst_ip="163.16.200.150" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.471710,2.323570,504,0 0 0 1 0 0 0 0 0 0 1 1,mptp">
        <slice>
            <filter dst_ip="202.132.223.64" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
