<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.715400,1.776060,010,0 0 0 0 0 0 0 0 0 0 0 1,ptpDoSSYN">
        <slice>
            <filter src_ip="130.132.131.192" dst_ip="120.59.206.205" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.437730,1.650310,999,1 1 1 0 0 0 0 0 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="208.247.43.1" dst_ip="151.109.170.205"/>
            <filter src_ip="208.85.205.228" dst_ip="151.109.170.205"/>
        </slice>
        <from usec="0" sec="1412917201"/>
        <to usec="0" sec="1412918008"/>
    </anomaly>
    <anomaly type="suspicious" value="1.107000,1.480210,010,1 1 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="206.110.75.131" dst_ip="179.136.245.166" dst_port="80"/>
        </slice>
        <from usec="0" sec="1412917201"/>
        <to usec="0" sec="1412918034"/>
    </anomaly>
    <anomaly type="suspicious" value="1.624460,1.650290,999,1 1 1 0 0 0 0 0 0 1 0 0,ipv4gretun">
        <slice>
            <filter src_ip="208.247.43.151" dst_ip="215.11.158.192"/>
            <filter src_ip="208.247.43.151" dst_ip="213.17.155.185"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.624460,1.650290,020,1 1 1 0 0 0 0 0 0 1 0 0,ntscICec">
        <slice>
            <filter src_ip="128.74.145.125"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.437730,1.650310,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="49.44.41.223" src_port="5145" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1412917374"/>
        <to usec="0" sec="1412917790"/>
    </anomaly>
    <anomaly type="suspicious" value="1.437730,1.650310,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="151.83.192.21" dst_port="23"/>
        </slice>
        <from usec="0" sec="1412917783"/>
        <to usec="0" sec="1412917799"/>
    </anomaly>
    <anomaly type="suspicious" value="1.083070,1.369330,999,1 1 0 0 0 0 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="130.149.221.64" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.437730,1.650310,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="100.205.93.94" dst_port="23"/>
        </slice>
        <from usec="0" sec="1412917368"/>
        <to usec="0" sec="1412917381"/>
    </anomaly>
    <anomaly type="suspicious" value="1.437730,1.650310,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="98.176.46.215" dst_port="23"/>
        </slice>
        <from usec="0" sec="1412917595"/>
        <to usec="0" sec="1412917602"/>
    </anomaly>
    <anomaly type="suspicious" value="1.437730,1.650310,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="165.19.37.97" dst_port="23"/>
        </slice>
        <from usec="0" sec="1412918005"/>
        <to usec="0" sec="1412918008"/>
    </anomaly>
    <anomaly type="suspicious" value="1.437730,1.650310,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.32.242.17" dst_port="23"/>
        </slice>
        <from usec="0" sec="1412917545"/>
        <to usec="0" sec="1412917556"/>
    </anomaly>
    <anomaly type="suspicious" value="1.437730,1.650310,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="173.127.234.89" dst_port="23"/>
        </slice>
        <from usec="0" sec="1412917835"/>
        <to usec="0" sec="1412917845"/>
    </anomaly>
    <anomaly type="suspicious" value="1.437730,1.650310,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="149.140.36.159" dst_port="23"/>
        </slice>
        <from usec="0" sec="1412917231"/>
        <to usec="0" sec="1412917242"/>
    </anomaly>
    <anomaly type="suspicious" value="1.437730,1.650310,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="4.223.183.195" dst_port="23"/>
        </slice>
        <from usec="0" sec="1412917929"/>
        <to usec="0" sec="1412917940"/>
    </anomaly>
    <anomaly type="suspicious" value="1.521120,1.669510,020,1 1 1 0 0 0 1 1 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="98.176.46.215"/>
        </slice>
        <from usec="0" sec="1412917561"/>
        <to usec="0" sec="1412917607"/>
    </anomaly>
    <anomaly type="suspicious" value="1.437730,1.650310,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="90.84.102.73"/>
        </slice>
        <from usec="0" sec="1412917796"/>
        <to usec="0" sec="1412917798"/>
    </anomaly>
    <anomaly type="suspicious" value="1.437730,1.650310,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="34.209.193.46" dst_port="22"/>
        </slice>
        <from usec="0" sec="1412917668"/>
        <to usec="0" sec="1412917810"/>
    </anomaly>
    <anomaly type="suspicious" value="1.315530,1.635240,011,1 0 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="4.214.75.187" src_port="8088" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1412917224"/>
        <to usec="0" sec="1412917226"/>
    </anomaly>
    <anomaly type="suspicious" value="1.323840,1.655490,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="179.136.111.11" src_port="8000" dst_port="6000" proto="tcp"/>
        </slice>
        <from usec="0" sec="1412917224"/>
        <to usec="0" sec="1412917227"/>
    </anomaly>
    <anomaly type="suspicious" value="1.437730,1.650310,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="208.207.34.110" src_port="80"/>
        </slice>
        <from usec="0" sec="1412917325"/>
        <to usec="0" sec="1412918097"/>
    </anomaly>
    <anomaly type="suspicious" value="1.437730,1.650310,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="201.169.195.114" dst_port="23"/>
        </slice>
        <from usec="0" sec="1412917587"/>
        <to usec="0" sec="1412917601"/>
    </anomaly>
    <anomaly type="suspicious" value="1.437730,1.650310,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="169.167.97.164" dst_port="23"/>
        </slice>
        <from usec="0" sec="1412917319"/>
        <to usec="0" sec="1412917921"/>
    </anomaly>
    <anomaly type="suspicious" value="1.384580,1.538070,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1412917201"/>
        <to usec="0" sec="1412918029"/>
    </anomaly>
    <anomaly type="suspicious" value="1.384580,1.538070,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1412917201"/>
        <to usec="0" sec="1412918029"/>
    </anomaly>
    <anomaly type="suspicious" value="1.384580,1.538070,503,0 0 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="179.136.108.234"/>
        </slice>
        <from usec="0" sec="1412917201"/>
        <to usec="0" sec="1412917399"/>
    </anomaly>
    <anomaly type="suspicious" value="1.384580,1.538070,011,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="129.144.78.165"/>
        </slice>
        <from usec="0" sec="1412917202"/>
        <to usec="0" sec="1412917656"/>
    </anomaly>
    <anomaly type="suspicious" value="1.384580,1.538070,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="132.38.132.49"/>
        </slice>
        <from usec="0" sec="1412917216"/>
        <to usec="0" sec="1412917611"/>
    </anomaly>
    <anomaly type="suspicious" value="1.384580,1.538070,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="193.169.45.80"/>
        </slice>
        <from usec="0" sec="1412917631"/>
        <to usec="0" sec="1412917673"/>
    </anomaly>
    <anomaly type="suspicious" value="1.568050,1.626950,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1412917201"/>
        <to usec="0" sec="1412918029"/>
    </anomaly>
    <anomaly type="suspicious" value="1.568050,1.626950,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1412917201"/>
        <to usec="0" sec="1412918029"/>
    </anomaly>
    <anomaly type="suspicious" value="1.634520,1.694730,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1412917201"/>
        <to usec="0" sec="1412918029"/>
    </anomaly>
    <anomaly type="suspicious" value="1.634520,1.694730,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1412917201"/>
        <to usec="0" sec="1412918029"/>
    </anomaly>
    <anomaly type="suspicious" value="1.627800,1.674950,504,1 0 0 0 0 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="132.38.197.4" dst_port="443"/>
        </slice>
        <from usec="0" sec="1412917262"/>
        <to usec="0" sec="1412917738"/>
    </anomaly>
    <anomaly type="suspicious" value="1.459110,1.651950,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="4.189.225.79" src_port="18324" dst_port="22"/>
        </slice>
        <from usec="0" sec="1412917246"/>
        <to usec="0" sec="1412917292"/>
    </anomaly>
    <anomaly type="suspicious" value="1.217700,1.485950,999,0 0 0 0 0 0 1 1 1 1 0 0,mptpla">
        <slice>
            <filter src_ip="209.57.151.158" dst_ip="5.78.199.182" dst_port="53"/>
            <filter src_ip="209.50.161.46" dst_ip="5.78.199.182" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.165270,1.390470,999,1 1 0 0 0 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="122.14.164.185" src_port="53"/>
            <filter dst_ip="208.247.36.22" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.459110,1.651950,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="184.112.54.162" dst_port="5666"/>
        </slice>
        <from usec="0" sec="1412917415"/>
        <to usec="0" sec="1412918053"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208660,1.463350,503,1 0 0 0 0 0 1 1 1 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="148.113.182.159" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208660,1.463350,504,1 0 0 0 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter dst_ip="69.177.49.44" dst_port="443"/>
            <filter dst_ip="184.169.44.163" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208660,1.463350,504,1 0 0 0 0 0 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="184.169.29.20" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.217700,1.485950,503,0 0 0 0 0 0 1 1 1 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="179.136.11.131" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.217700,1.485950,999,0 0 0 0 0 0 1 1 1 1 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="108.98.208.112" dst_ip="148.113.194.219"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.396570,1.431140,504,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="77.44.239.171" src_port="443"/>
            <filter src_ip="77.44.239.171" src_port="80"/>
            <filter dst_ip="179.136.178.148" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.217700,1.485950,999,0 0 0 0 0 0 1 1 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="148.113.177.97" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.054080,1.367360,503,1 1 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="105.128.110.20" dst_ip="130.149.52.32" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.396570,1.431140,503,1 0 0 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="179.136.111.11" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926572,1.375560,999,0 0 0 0 0 0 1 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="148.113.177.193" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.404400,1.454240,504,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="105.128.110.106" dst_ip="148.113.139.90" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.217700,1.485950,999,0 0 0 0 0 0 1 1 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="148.113.248.98" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926572,1.375560,504,0 0 0 0 0 0 1 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="209.57.25.152" dst_ip="117.80.110.236"/>
            <filter src_ip="209.57.25.152" dst_port="443"/>
            <filter src_ip="209.57.25.6" dst_ip="117.80.110.236" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.396570,1.431140,503,1 0 0 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="130.149.96.166" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.445330,1.670380,999,0 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.105.143.136" dst_port="53"/>
        </slice>
        <from usec="0" sec="1412917205"/>
        <to usec="0" sec="1412918065"/>
    </anomaly>
    <anomaly type="suspicious" value="1.396570,1.431140,503,1 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="108.155.172.34" dst_ip="179.136.177.69" src_port="80" dst_port="48223"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.404400,1.454240,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="77.44.239.147" src_port="80"/>
            <filter dst_ip="179.136.177.123" src_port="80"/>
            <filter dst_ip="179.136.177.123" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.404400,1.454240,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="195.62.234.145" dst_ip="148.113.194.17" src_port="80"/>
            <filter src_ip="195.62.234.160" dst_ip="148.113.194.17" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.404400,1.454240,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="77.44.237.33" dst_ip="179.136.178.108" src_port="80"/>
            <filter src_ip="77.44.237.114" dst_ip="179.136.178.108" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.396570,1.431140,504,1 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="179.136.108.178" src_port="443"/>
            <filter src_ip="114.48.29.204" dst_ip="179.136.108.178" src_port="22222"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.418570,1.433020,999,1 0 0 0 0 0 1 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="5.198.33.229" dst_ip="179.136.111.11" src_port="8000"/>
            <filter src_ip="101.207.161.53" dst_ip="179.136.111.11" src_port="8000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.404400,1.454240,999,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="209.57.130.138" dst_port="1863"/>
            <filter src_ip="105.142.62.110" dst_ip="209.57.130.138" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.512230,1.448340,504,1 1 0 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="132.38.96.169" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.567960,2.055340,503,1 1 1 0 0 0 1 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="209.57.25.6" dst_port="80"/>
            <filter src_ip="209.57.25.6" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.512230,1.448340,503,1 1 0 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="209.57.25.152" dst_port="80"/>
            <filter src_ip="209.57.25.152" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.623760,1.539300,504,1 0 0 0 0 0 1 1 1 1 1 0,mptp">
        <slice>
            <filter dst_ip="184.169.47.161" dst_port="443"/>
            <filter dst_ip="184.169.47.161" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.473340,2.431180,503,1 1 0 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="209.57.25.152" src_port="80"/>
            <filter dst_ip="209.57.25.152" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.686720,2.600850,503,1 1 1 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="148.113.182.32" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.891220,2.145750,503,1 1 0 1 1 0 0 0 0 0 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="179.136.178.130" src_port="443"/>
            <filter dst_ip="179.136.178.130" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.512230,1.448340,504,1 1 0 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="132.38.73.222" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.385560,1.920030,503,1 1 0 0 0 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="208.247.43.104" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.890040,1.670310,503,1 0 0 1 0 0 1 0 1 0 1 0,ntscACK">
        <slice>
            <filter src_ip="209.50.147.120" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.237110,1.834460,011,1 1 0 0 0 0 0 0 0 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="4.214.75.187" src_port="8088" dst_port="6000"/>
            <filter dst_ip="100.21.225.216" src_port="1433" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.858410,2.101210,999,1 1 0 1 1 1 1 1 1 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="208.247.36.22" dst_port="53"/>
            <filter src_ip="208.247.36.20" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.592450,2.538340,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="92.233.184.42" src_port="36001" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.592450,2.538340,011,1 1 1 1 1 1 0 0 0 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="137.67.73.130" src_port="3389"/>
            <filter dst_ip="162.163.96.109" src_port="1723"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.597130,1.539790,503,0 0 0 1 0 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="209.50.173.237" src_port="443"/>
            <filter dst_ip="209.50.173.237" src_port="53"/>
            <filter dst_ip="209.50.173.237" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.927520,2.082320,503,1 0 0 1 1 1 1 1 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="132.38.229.215" dst_port="80"/>
            <filter dst_ip="222.17.181.114" dst_port="80"/>
            <filter dst_ip="222.17.181.125" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.037420,1.767980,504,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="130.149.33.241" dst_ip="114.228.91.225" dst_port="443"/>
        </slice>
        <from usec="0" sec="1412917262"/>
        <to usec="0" sec="1412917662"/>
    </anomaly>
    <anomaly type="anomalous" value="2.568650,2.027560,504,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="209.50.173.237" dst_ip="165.67.4.198" dst_port="443"/>
        </slice>
        <from usec="0" sec="1412917441"/>
        <to usec="0" sec="1412917656"/>
    </anomaly>
    <anomaly type="anomalous" value="2.568650,2.027560,999,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="206.21.130.75" dst_ip="208.247.38.173" src_port="55558" dst_port="8080"/>
            <filter src_ip="206.21.130.75" dst_ip="208.247.38.173" src_port="50301" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1412917815"/>
        <to usec="0" sec="1412917826"/>
    </anomaly>
    <anomaly type="anomalous" value="2.568650,2.027560,999,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="130.149.221.64" dst_ip="33.23.39.102" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1412917201"/>
        <to usec="0" sec="1412917500"/>
    </anomaly>
    <anomaly type="anomalous" value="2.677650,2.027540,503,0 0 0 1 1 1 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="105.128.105.2" src_port="80"/>
            <filter dst_ip="148.113.147.16" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.029480,2.160530,503,1 1 0 1 1 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="208.247.33.61" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.230260,2.288970,999,1 1 1 1 1 1 1 1 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="130.149.221.65" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.698720,1.669490,010,1 1 1 0 0 0 1 1 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="100.21.225.216" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.001630,2.143260,503,1 0 0 1 1 1 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="208.247.46.62" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.686760,2.130800,010,1 1 1 0 0 0 1 1 1 1 1 1,ptpDoSSYN">
        <slice>
            <filter src_ip="130.132.131.192" dst_ip="120.59.206.205" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.724250,1.555300,504,1 1 0 0 0 0 1 1 1 1 1 0,mptp">
        <slice>
            <filter dst_ip="69.177.54.220" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.677650,2.027540,504,0 0 0 1 1 1 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="179.136.108.13" src_port="443"/>
            <filter dst_ip="179.136.108.13" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.473340,2.431180,504,1 1 0 1 1 1 1 1 1 1 1 1,ntscACK">
        <slice>
            <filter src_ip="105.128.105.57" src_port="80"/>
            <filter src_ip="105.128.105.57" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.015290,1.736440,010,1 1 1 0 0 0 1 1 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="137.67.73.130" dst_port="3389"/>
            <filter src_ip="4.214.75.187" src_port="6000" dst_port="8088"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.165680,1.839120,503,0 0 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="208.247.33.61" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.512230,1.448340,503,1 1 0 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="179.136.22.115" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.885070,2.066960,504,1 0 0 1 1 1 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="132.38.98.84" dst_ip="11.138.189.173" src_port="55784" dst_port="443"/>
            <filter src_ip="132.38.98.84" dst_ip="11.138.189.173" src_port="55783" dst_port="443"/>
            <filter src_ip="132.38.98.119" dst_ip="11.138.189.173" src_port="61970" dst_port="443"/>
            <filter src_ip="132.38.98.119" dst_ip="11.138.189.173" src_port="61969" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.165680,1.839120,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="130.149.193.236" dst_ip="122.25.233.19" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.326170,2.367800,503,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="125.166.62.85" dst_ip="132.38.120.120" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.587850,1.960620,503,1 1 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="208.247.43.104" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.592450,2.538340,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="6.228.237.6" src_port="36747" dst_port="5666"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.552990,1.540240,503,0 0 0 0 0 0 0 0 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="179.136.20.28" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.630500,1.560800,999,0 0 0 0 0 0 1 1 1 1 1 0,alphfl">
        <slice>
            <filter src_ip="114.49.206.134" dst_ip="209.50.131.64" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.626630,2.550860,010,1 1 1 1 1 1 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="162.163.96.109" dst_port="1723"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.165680,1.839120,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="77.44.239.147" src_port="80"/>
            <filter dst_ip="179.136.109.170" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
