<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.418090,1.671590,999,1 1 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.98.177.86" dst_port="993"/>
            <filter dst_ip="133.98.177.86" dst_port="443"/>
        </slice>
        <from usec="0" sec="1410238800"/>
        <to usec="0" sec="1410239667"/>
    </anomaly>
    <anomaly type="suspicious" value="1.418090,1.671590,503,1 1 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="61.135.171.17" dst_ip="180.23.45.178" dst_port="80"/>
            <filter src_ip="192.222.135.184" dst_ip="180.23.45.178" dst_port="80"/>
        </slice>
        <from usec="0" sec="1410238801"/>
        <to usec="0" sec="1410239698"/>
    </anomaly>
    <anomaly type="suspicious" value="1.564150,1.631400,503,1 1 0 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="180.23.240.108" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.292150,1.653210,999,1 1 1 0 0 0 1 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="5.86.118.200" src_port="57246" dst_port="1900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.564150,1.631400,503,1 1 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="176.117.191.194" src_port="63601"/>
            <filter src_ip="176.117.191.194" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.202430,1.605630,020,1 1 1 0 0 0 0 0 0 1 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="70.137.81.123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.432340,1.728010,999,1 0 0 1 1 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="200.227.246.210" dst_port="19"/>
        </slice>
        <from usec="0" sec="1410239100"/>
        <to usec="0" sec="1410239296"/>
    </anomaly>
    <anomaly type="suspicious" value="1.268300,1.722720,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1410238800"/>
        <to usec="0" sec="1410239628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.356680,1.717440,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="180.23.16.168" dst_ip="108.54.251.148"/>
            <filter src_ip="180.23.16.168" dst_ip="208.120.6.165"/>
            <filter src_ip="180.23.16.168" dst_port="443"/>
            <filter src_ip="180.23.16.168" dst_port="80"/>
            <filter dst_ip="108.54.251.148" dst_port="443"/>
            <filter dst_ip="208.120.6.165" dst_port="443"/>
        </slice>
        <from usec="0" sec="1410238800"/>
        <to usec="0" sec="1410238998"/>
    </anomaly>
    <anomaly type="suspicious" value="1.356680,1.717440,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="90.24.53.233" dst_ip="200.227.251.43" dst_port="80"/>
        </slice>
        <from usec="0" sec="1410238800"/>
        <to usec="0" sec="1410238987"/>
    </anomaly>
    <anomaly type="suspicious" value="1.356680,1.717440,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="176.117.218.47" dst_ip="48.54.173.47" dst_port="443"/>
            <filter src_ip="176.117.218.47" dst_ip="48.54.22.251" dst_port="443"/>
            <filter src_ip="176.117.218.47" dst_ip="85.132.202.186" dst_port="443"/>
        </slice>
        <from usec="0" sec="1410238800"/>
        <to usec="0" sec="1410239083"/>
    </anomaly>
    <anomaly type="suspicious" value="1.356680,1.717440,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="69.19.189.4" dst_ip="180.23.240.104" src_port="51655" dst_port="993"/>
            <filter src_ip="69.19.189.4" dst_ip="180.23.240.104" src_port="51653" dst_port="993"/>
        </slice>
        <from usec="0" sec="1410238833"/>
        <to usec="0" sec="1410239084"/>
    </anomaly>
    <anomaly type="suspicious" value="1.356680,1.717440,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="46.27.80.139" dst_ip="201.64.38.36" src_port="80" dst_port="51645"/>
            <filter src_ip="46.27.80.139" dst_ip="201.64.38.36" src_port="80" dst_port="51644"/>
            <filter src_ip="46.27.80.139" dst_ip="201.64.38.36" src_port="80" dst_port="51641"/>
            <filter src_ip="46.27.80.139" dst_ip="201.64.38.36" src_port="80" dst_port="51637"/>
        </slice>
        <from usec="0" sec="1410238955"/>
        <to usec="0" sec="1410238989"/>
    </anomaly>
    <anomaly type="suspicious" value="1.356680,1.717440,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="201.74.135.236" dst_ip="201.64.40.166" src_port="80"/>
        </slice>
        <from usec="0" sec="1410238968"/>
        <to usec="0" sec="1410239064"/>
    </anomaly>
    <anomaly type="suspicious" value="1.356680,1.717440,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.29.116.219" dst_ip="206.71.58.177" src_port="54418" dst_port="443"/>
            <filter src_ip="163.29.116.219" dst_ip="206.71.58.177" src_port="54417" dst_port="443"/>
            <filter src_ip="163.29.116.219" dst_ip="206.71.58.177" src_port="54389" dst_port="443"/>
            <filter src_ip="163.29.116.219" dst_ip="206.71.69.154" src_port="51246" dst_port="80"/>
        </slice>
        <from usec="0" sec="1410239008"/>
        <to usec="0" sec="1410239082"/>
    </anomaly>
    <anomaly type="suspicious" value="1.356680,1.717440,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="151.141.107.213" dst_ip="180.12.180.48" src_port="2156" dst_port="14792"/>
        </slice>
        <from usec="0" sec="1410238800"/>
        <to usec="0" sec="1410239178"/>
    </anomaly>
    <anomaly type="suspicious" value="1.268300,1.722720,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1410238800"/>
        <to usec="0" sec="1410239268"/>
    </anomaly>
    <anomaly type="suspicious" value="1.356680,1.717440,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="29.206.171.31" dst_ip="180.179.0.42" src_port="443"/>
            <filter src_ip="29.206.171.31" dst_ip="180.179.0.42" src_port="80"/>
        </slice>
        <from usec="0" sec="1410239168"/>
        <to usec="0" sec="1410239249"/>
    </anomaly>
    <anomaly type="suspicious" value="1.356680,1.717440,503,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="136.24.209.28" dst_ip="180.23.224.152" dst_port="80"/>
        </slice>
        <from usec="0" sec="1410238832"/>
        <to usec="0" sec="1410239347"/>
    </anomaly>
    <anomaly type="suspicious" value="1.356680,1.717440,502,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="180.3.182.1" dst_ip="203.192.163.82" src_port="22"/>
        </slice>
        <from usec="0" sec="1410238801"/>
        <to usec="0" sec="1410239447"/>
    </anomaly>
    <anomaly type="suspicious" value="1.356680,1.717440,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="133.98.37.38" src_port="10784"/>
            <filter src_ip="133.98.37.38" dst_ip="54.59.144.183" dst_port="80"/>
        </slice>
        <from usec="0" sec="1410238846"/>
        <to usec="0" sec="1410239441"/>
    </anomaly>
    <anomaly type="suspicious" value="1.356680,1.717440,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="193.88.27.165" dst_port="1080"/>
        </slice>
        <from usec="0" sec="1410238800"/>
        <to usec="0" sec="1410239538"/>
    </anomaly>
    <anomaly type="suspicious" value="1.599690,1.715360,999,0 0 0 1 1 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="176.117.138.139" dst_port="25957"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.356680,1.717440,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.98.37.48" src_port="17228"/>
        </slice>
        <from usec="0" sec="1410238801"/>
        <to usec="0" sec="1410239622"/>
    </anomaly>
    <anomaly type="suspicious" value="1.356680,1.717440,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="90.115.13.228" dst_ip="200.227.245.70" src_port="2059" dst_port="4464"/>
        </slice>
        <from usec="0" sec="1410238804"/>
        <to usec="0" sec="1410239618"/>
    </anomaly>
    <anomaly type="suspicious" value="1.356680,1.717440,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="201.64.37.21" dst_ip="213.184.187.63" dst_port="443"/>
            <filter src_ip="201.64.37.21" dst_ip="213.184.187.62" dst_port="443"/>
        </slice>
        <from usec="0" sec="1410238816"/>
        <to usec="0" sec="1410239617"/>
    </anomaly>
    <anomaly type="suspicious" value="1.494920,1.717350,503,1 1 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="201.64.157.3" dst_port="80"/>
            <filter src_ip="48.153.26.106" dst_ip="180.23.240.110" dst_port="80"/>
        </slice>
        <from usec="0" sec="1410238800"/>
        <to usec="0" sec="1410239698"/>
    </anomaly>
    <anomaly type="suspicious" value="2.054340,2.090430,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1410238800"/>
        <to usec="0" sec="1410239268"/>
    </anomaly>
    <anomaly type="suspicious" value="2.054340,2.090430,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1410238800"/>
        <to usec="0" sec="1410239628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.165990,1.633250,999,1 0 0 1 0 0 1 0 0 1 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="38.104.216.69" dst_ip="170.42.196.220"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.610500,1.741680,504,1 1 1 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="180.8.238.180" dst_port="443"/>
            <filter dst_ip="20.87.199.170" dst_port="443"/>
        </slice>
        <from usec="0" sec="1410238800"/>
        <to usec="0" sec="1410239698"/>
    </anomaly>
    <anomaly type="suspicious" value="1.165990,1.633250,503,1 0 0 1 0 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="170.42.110.148" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.171470,1.669180,503,0 0 0 1 0 0 1 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="46.24.93.18" dst_ip="170.42.199.68" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.165990,1.633250,999,1 0 0 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_port="53"/>
            <filter dst_ip="200.227.242.76" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.508710,1.678340,504,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="107.20.197.189" dst_ip="170.42.20.88" src_port="443"/>
            <filter src_ip="107.17.120.36" dst_ip="170.42.20.88" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148440,1.573440,503,1 1 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="133.98.248.216" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.599690,1.715360,504,0 0 0 1 1 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="133.98.151.131" src_port="443"/>
            <filter dst_ip="133.98.151.131" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.508710,1.678340,501,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="180.179.32.116" dst_ip="221.19.72.155"/>
            <filter src_ip="180.179.32.117" dst_ip="221.19.72.155" src_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.508710,1.678340,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="192.33.195.72" dst_ip="133.98.67.201" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.508710,1.678340,999,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="200.227.253.148" dst_ip="63.73.196.42"/>
            <filter src_ip="200.227.253.148" dst_ip="22.229.175.165"/>
            <filter src_ip="200.227.253.148"/>
            <filter src_ip="200.227.253.148"/>
            <filter dst_ip="63.73.196.42"/>
            <filter dst_ip="63.73.196.42"/>
            <filter dst_ip="22.229.175.165"/>
            <filter dst_ip="22.229.175.165"/>
            <filter src_ip="200.227.253.148" dst_ip="19.2.180.40" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.508710,1.678340,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="124.88.171.206" dst_ip="180.23.225.106" src_port="80" dst_port="49644"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.508710,1.678340,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="2.95.203.242" dst_ip="170.42.67.31" src_port="80" dst_port="53264"/>
            <filter src_ip="2.95.203.242" dst_ip="170.42.67.31" src_port="80" dst_port="53258"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.508710,1.678340,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="180.23.240.110" dst_ip="48.153.26.106" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.504450,1.642610,999,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="165.54.49.61" dst_ip="176.117.78.31" src_port="60716" dst_port="25"/>
            <filter src_ip="165.54.49.61" dst_ip="176.117.202.7" src_port="49660" dst_port="25"/>
            <filter src_ip="16.86.239.165" dst_ip="176.117.78.31" src_port="5378" dst_port="9943"/>
            <filter src_ip="74.142.138.24" dst_ip="176.117.78.31" src_port="4138" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.583730,1.672920,999,0 0 0 1 0 0 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="18.215.22.221" dst_ip="180.23.161.45"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.508710,1.678340,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="180.8.213.194" dst_ip="201.133.85.10" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.583730,1.672920,504,0 0 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="201.64.52.76" src_port="443"/>
            <filter dst_ip="201.64.52.76" src_port="80"/>
            <filter src_ip="162.185.244.92" dst_ip="201.64.52.76" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.508710,1.678340,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="192.129.24.10" dst_ip="201.64.56.194" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.508710,1.678340,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="29.194.52.192" dst_ip="201.64.39.140" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.508710,1.678340,999,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="200.227.250.210" src_port="53" dst_port="161"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.583730,1.672920,999,0 0 0 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="200.227.245.2" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.266270,1.825240,999,1 1 1 0 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="200.227.243.175" dst_ip="207.24.160.190"/>
            <filter src_ip="200.227.243.175" dst_ip="205.161.188.108"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.636640,1.625820,504,1 1 0 1 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="180.179.26.14" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.286430,2.310450,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="198.61.198.246" src_port="58089" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.231360,2.292160,503,1 1 0 1 1 1 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="200.227.248.113" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.185650,1.802040,503,1 1 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="176.117.97.81" dst_port="80"/>
            <filter dst_ip="29.46.93.96" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.266270,1.825240,010,1 1 1 0 0 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="221.40.132.162" dst_port="10022"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.076740,1.763440,503,1 1 0 1 1 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.742840,1.651500,999,1 1 1 1 0 0 0 0 0 1 1 0,ipv46tun">
        <slice>
            <filter src_ip="200.227.243.12" dst_ip="168.186.20.154"/>
            <filter src_ip="200.227.243.12" dst_ip="192.180.170.54" src_port="62078" dst_port="23560"/>
            <filter src_ip="200.46.15.134" dst_ip="168.186.20.154"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.265810,2.325740,503,1 1 0 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="200.227.248.113" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.757350,1.694470,010,1 1 1 1 1 0 0 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="34.205.242.37" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.204890,2.325810,999,0 0 0 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="200.227.253.144" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.032160,1.773820,999,1 0 0 1 1 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="180.3.178.144" src_port="80"/>
            <filter dst_ip="180.3.178.144" dst_port="11889"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="9.129290,7.990310,010,1 1 1 1 1 1 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="91.30.13.22" dst_port="22"/>
            <filter src_ip="38.40.10.245" src_port="6000" dst_port="22"/>
            <filter src_ip="90.86.170.68" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.718480,1.715270,010,1 1 0 1 1 0 1 0 0 1 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="200.227.245.128" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.286430,2.310450,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="203.34.172.136" src_port="48735" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.286430,2.310450,503,1 1 1 1 1 1 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="201.245.218.36" src_port="80"/>
            <filter src_ip="213.180.112.140" dst_ip="201.64.58.174" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.320310,2.343770,503,1 1 1 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="170.42.157.130" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.266270,1.825240,010,1 1 1 0 0 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="216.169.45.36" dst_port="23"/>
            <filter src_ip="216.169.45.36" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.364690,1.862370,503,1 1 1 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="200.227.244.71"/>
            <filter dst_ip="170.42.157.49" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.320310,2.343770,503,1 1 1 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="200.227.243.93" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.499830,1.922470,503,0 0 0 1 1 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="133.98.31.28" src_port="80"/>
            <filter dst_ip="133.98.31.28" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.646170,1.944160,504,1 1 1 1 1 0 1 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="39.14.94.145" src_port="80"/>
            <filter src_ip="39.14.94.145" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.316890,1.820260,010,1 1 1 1 0 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="38.40.10.130" src_port="6000" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.146320,1.844640,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="164.236.8.242" dst_ip="180.3.178.138" src_port="80"/>
            <filter src_ip="164.236.8.242" dst_ip="180.3.178.138" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.286430,2.310450,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="70.137.87.89" src_port="12200" dst_port="3128"/>
            <filter src_ip="70.137.87.89" src_port="12200" dst_port="80"/>
            <filter src_ip="70.137.87.89" src_port="12200" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.497260,1.891360,504,1 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="29.194.52.59" src_port="80"/>
            <filter src_ip="29.194.52.59" src_port="443"/>
            <filter dst_ip="133.98.173.168" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.146320,1.844640,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="133.98.29.90" src_port="443"/>
            <filter dst_ip="133.98.29.90" src_port="995"/>
            <filter dst_ip="133.98.29.90" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.418670,2.131770,503,1 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="90.145.57.121" src_port="80"/>
            <filter src_ip="29.194.52.233" src_port="80"/>
            <filter dst_ip="200.227.255.218" src_port="80"/>
        </slice>
        <from usec="0" sec="1410238802"/>
        <to usec="0" sec="1410239624"/>
    </anomaly>
    <anomaly type="anomalous" value="2.646170,1.944160,503,1 1 1 1 1 0 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="201.75.16.92" dst_port="80"/>
            <filter src_ip="201.75.16.92" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.320310,2.343770,503,1 1 1 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="201.75.16.92" src_port="80"/>
            <filter dst_ip="201.75.16.92" src_port="443"/>
            <filter dst_ip="201.75.16.92" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.231360,2.292160,999,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="200.227.253.189"/>
            <filter src_ip="200.227.253.170" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.146320,1.844640,503,0 0 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="133.98.248.216" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.146320,1.844640,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="170.42.196.196" src_port="443"/>
            <filter dst_ip="170.42.196.196" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.204890,2.325810,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="133.98.94.64" src_port="80"/>
            <filter src_ip="162.185.244.66" dst_ip="133.98.94.64" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.146320,1.844640,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="200.227.253.159" src_port="8080"/>
            <filter src_ip="200.227.253.159" src_port="80"/>
            <filter src_ip="200.227.253.159"/>
            <filter src_ip="200.227.253.159"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.497260,1.891360,503,1 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter src_ip="108.168.191.52" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.202890,2.300160,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="200.227.243.93" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.237640,2.333620,503,1 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="133.98.94.195"/>
            <filter src_port="80"/>
            <filter src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
