<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.713130,1.848510,504,0 0 0 0 0 0 0 0 0 0 0 1,mptpla">
        <slice>
            <filter src_ip="147.240.149.175" dst_ip="53.85.94.130" src_port="50413" dst_port="443"/>
            <filter src_ip="147.240.149.175" dst_ip="53.85.94.130" src_port="50410" dst_port="443"/>
            <filter src_ip="147.240.138.214" dst_ip="53.85.94.130" src_port="58456" dst_port="443"/>
            <filter src_ip="147.240.138.214" dst_ip="53.85.94.130" src_port="58455" dst_port="443"/>
            <filter src_ip="147.240.148.187" dst_ip="53.85.94.130" src_port="57027" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.277410,1.420020,504,1 1 0 1 0 0 1 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="149.243.37.110" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.435710,1.555810,504,1 1 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="114.72.121.133" dst_port="443"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682888"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420550,1.521340,504,1 1 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="149.243.87.252" dst_port="80"/>
            <filter src_ip="149.243.87.252" dst_port="443"/>
            <filter dst_ip="9.180.121.65" dst_port="80"/>
        </slice>
        <from usec="0" sec="1415682002"/>
        <to usec="0" sec="1415682867"/>
    </anomaly>
    <anomaly type="suspicious" value="1.358380,1.516650,010,1 1 1 1 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="212.145.247.249" dst_port="23"/>
        </slice>
        <from usec="0" sec="1415682160"/>
        <to usec="0" sec="1415682901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.435710,1.555810,504,1 1 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="61.12.105.37" dst_port="443"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682853"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="174.69.169.208" dst_ip="147.86.129.179" src_port="80" dst_port="38"/>
            <filter src_ip="174.69.169.208" dst_ip="186.30.103.160" src_port="80" dst_port="95"/>
            <filter src_ip="174.69.169.208" dst_ip="214.133.17.201" src_port="80" dst_port="766"/>
            <filter src_ip="174.69.169.208" dst_ip="143.97.221.71" src_port="80" dst_port="347"/>
        </slice>
        <from usec="0" sec="1415682284"/>
        <to usec="0" sec="1415682884"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="74.114.236.223" dst_ip="215.114.143.156" src_port="38463" dst_port="25"/>
        </slice>
        <from usec="0" sec="1415682007"/>
        <to usec="0" sec="1415682009"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="74.114.237.221" dst_ip="215.114.143.156" src_port="63676" dst_port="25"/>
        </slice>
        <from usec="0" sec="1415682260"/>
        <to usec="0" sec="1415682262"/>
    </anomaly>
    <anomaly type="suspicious" value="1.116300,1.400900,504,1 1 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="149.243.64.6" dst_port="80"/>
            <filter src_ip="149.243.64.6" dst_ip="61.12.100.58" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="50.56.211.55" dst_ip="215.114.143.156" src_port="39247" dst_port="25"/>
        </slice>
        <from usec="0" sec="1415682505"/>
        <to usec="0" sec="1415682508"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="50.56.241.185" dst_ip="215.114.143.156" src_port="54729" dst_port="25"/>
        </slice>
        <from usec="0" sec="1415682192"/>
        <to usec="0" sec="1415682194"/>
    </anomaly>
    <anomaly type="suspicious" value="1.435710,1.555810,503,1 1 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="149.243.25.183" dst_port="80"/>
            <filter src_ip="149.243.25.183" dst_port="443"/>
            <filter dst_ip="222.132.77.221" dst_port="80"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682900"/>
    </anomaly>
    <anomaly type="suspicious" value="1.189080,1.407490,503,1 1 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="147.112.9.231" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,999,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="214.133.83.49" dst_ip="223.67.248.79" dst_port="53"/>
            <filter src_ip="214.133.83.149" dst_ip="223.67.248.79" dst_port="53"/>
            <filter src_ip="214.133.83.59" dst_ip="223.67.248.79" dst_port="53"/>
            <filter src_ip="214.133.83.54" dst_ip="223.67.248.79" dst_port="53"/>
        </slice>
        <from usec="0" sec="1415682639"/>
        <to usec="0" sec="1415682643"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="91.62.157.232" dst_port="23"/>
        </slice>
        <from usec="0" sec="1415682326"/>
        <to usec="0" sec="1415682339"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.105.248.11" dst_port="23"/>
        </slice>
        <from usec="0" sec="1415682606"/>
        <to usec="0" sec="1415682618"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="203.168.148.30" dst_port="23"/>
        </slice>
        <from usec="0" sec="1415682011"/>
        <to usec="0" sec="1415682023"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="0.214.41.36" dst_port="23"/>
        </slice>
        <from usec="0" sec="1415682140"/>
        <to usec="0" sec="1415682153"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="0.133.46.227" dst_port="23"/>
        </slice>
        <from usec="0" sec="1415682610"/>
        <to usec="0" sec="1415682624"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="91.97.229.53" dst_port="23"/>
        </slice>
        <from usec="0" sec="1415682795"/>
        <to usec="0" sec="1415682806"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="161.125.190.138" dst_port="23"/>
        </slice>
        <from usec="0" sec="1415682001"/>
        <to usec="0" sec="1415682020"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="80.137.230.9" dst_port="23"/>
        </slice>
        <from usec="0" sec="1415682683"/>
        <to usec="0" sec="1415682687"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.2.153.86" dst_port="23"/>
        </slice>
        <from usec="0" sec="1415682077"/>
        <to usec="0" sec="1415682089"/>
    </anomaly>
    <anomaly type="suspicious" value="1.277410,1.420020,504,1 1 0 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter src_ip="149.243.36.228" dst_port="80"/>
            <filter dst_ip="222.132.77.209" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.376040,1.549860,999,1 1 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="214.133.69.132" dst_port="53"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682544"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="80.137.230.9"/>
        </slice>
        <from usec="0" sec="1415682683"/>
        <to usec="0" sec="1415682686"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,999,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="143.32.159.187" dst_port="25"/>
        </slice>
        <from usec="0" sec="1415682007"/>
        <to usec="0" sec="1415682740"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,504,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="149.243.227.66" dst_ip="125.194.184.1" src_port="49424" dst_port="443"/>
            <filter src_ip="149.243.227.66" dst_ip="125.194.184.1" src_port="49423" dst_port="443"/>
            <filter src_ip="149.243.227.66" dst_ip="125.194.184.1" src_port="49422" dst_port="443"/>
            <filter src_ip="149.243.227.66" dst_ip="125.194.184.1" src_port="49421" dst_port="443"/>
        </slice>
        <from usec="0" sec="1415682751"/>
        <to usec="0" sec="1415682755"/>
    </anomaly>
    <anomaly type="suspicious" value="1.094160,1.514150,999,1 0 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="50.163.26.218" dst_ip="215.114.143.156" src_port="60102" dst_port="25"/>
        </slice>
        <from usec="0" sec="1415682117"/>
        <to usec="0" sec="1415682120"/>
    </anomaly>
    <anomaly type="suspicious" value="1.295150,1.510540,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="81.90.76.127" src_port="6000" dst_port="22"/>
        </slice>
        <from usec="0" sec="1415682630"/>
        <to usec="0" sec="1415682684"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="215.114.143.156" dst_ip="194.11.57.105" dst_port="25"/>
        </slice>
        <from usec="0" sec="1415682084"/>
        <to usec="0" sec="1415682517"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,999,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="50.56.211.54" dst_ip="215.114.143.156" src_port="57232" dst_port="25"/>
        </slice>
        <from usec="0" sec="1415682466"/>
        <to usec="0" sec="1415682469"/>
    </anomaly>
    <anomaly type="suspicious" value="1.094160,1.514150,503,1 0 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="149.243.118.231" dst_port="80"/>
        </slice>
        <from usec="0" sec="1415682046"/>
        <to usec="0" sec="1415682880"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="50.56.211.54" dst_ip="215.114.143.156" src_port="53801" dst_port="25"/>
        </slice>
        <from usec="0" sec="1415682189"/>
        <to usec="0" sec="1415682191"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="116.212.61.161" dst_ip="214.133.85.101" dst_port="53"/>
            <filter src_ip="116.212.61.161" dst_ip="214.133.85.91" dst_port="53"/>
            <filter src_ip="116.212.61.161" dst_ip="214.133.85.108" dst_port="53"/>
        </slice>
        <from usec="0" sec="1415682561"/>
        <to usec="0" sec="1415682661"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="86.132.183.207" src_port="37660" dst_port="3661"/>
        </slice>
        <from usec="0" sec="1415682838"/>
        <to usec="0" sec="1415682839"/>
    </anomaly>
    <anomaly type="suspicious" value="1.210350,1.535860,010,0 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="64.168.88.203" src_port="12200" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1415682747"/>
        <to usec="0" sec="1415682753"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="223.236.36.208" src_port="80"/>
        </slice>
        <from usec="0" sec="1415682341"/>
        <to usec="0" sec="1415682343"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,999,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="149.243.169.94" dst_ip="218.173.163.229" dst_port="53"/>
        </slice>
        <from usec="0" sec="1415682425"/>
        <to usec="0" sec="1415682427"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="203.214.248.115" dst_port="23"/>
        </slice>
        <from usec="0" sec="1415682505"/>
        <to usec="0" sec="1415682517"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="203.214.248.170" dst_port="23"/>
        </slice>
        <from usec="0" sec="1415682778"/>
        <to usec="0" sec="1415682791"/>
    </anomaly>
    <anomaly type="suspicious" value="1.094160,1.514150,010,1 0 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="109.91.166.248" dst_port="23"/>
        </slice>
        <from usec="0" sec="1415682781"/>
        <to usec="0" sec="1415682787"/>
    </anomaly>
    <anomaly type="suspicious" value="1.208120,1.498770,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="81.90.64.154" src_port="22" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1415682488"/>
        <to usec="0" sec="1415682490"/>
    </anomaly>
    <anomaly type="suspicious" value="1.240050,1.524930,503,1 0 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="215.120.156.166" dst_port="80"/>
            <filter src_ip="215.120.156.166" dst_port="53"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682896"/>
    </anomaly>
    <anomaly type="suspicious" value="1.530810,1.571180,999,1 0 0 1 1 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="147.240.72.115" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420550,1.521340,504,1 1 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="147.240.151.195" dst_port="443"/>
            <filter dst_ip="114.72.121.133" dst_port="443"/>
        </slice>
        <from usec="0" sec="1415682002"/>
        <to usec="0" sec="1415682892"/>
    </anomaly>
    <anomaly type="suspicious" value="1.098630,1.468620,504,0 0 0 0 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="124.128.105.44" src_port="443"/>
            <filter dst_ip="149.243.21.134" src_port="80"/>
            <filter dst_ip="143.32.44.130" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.172750,1.555460,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682108"/>
    </anomaly>
    <anomaly type="suspicious" value="1.172750,1.555460,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682648"/>
    </anomaly>
    <anomaly type="suspicious" value="1.242230,1.561400,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="147.112.7.124" dst_port="53"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682185"/>
    </anomaly>
    <anomaly type="suspicious" value="1.242230,1.561400,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="149.243.150.174" dst_ip="212.32.20.135" src_port="5900"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682198"/>
    </anomaly>
    <anomaly type="suspicious" value="1.242230,1.561400,010,0 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="68.208.31.152" dst_port="5000"/>
            <filter src_ip="68.208.31.152" dst_port="80"/>
            <filter src_ip="68.208.31.152" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1415682032"/>
        <to usec="0" sec="1415682196"/>
    </anomaly>
    <anomaly type="suspicious" value="1.242230,1.561400,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="157.84.172.205" dst_ip="215.114.34.140" src_port="5041" dst_port="5829"/>
        </slice>
        <from usec="0" sec="1415682091"/>
        <to usec="0" sec="1415682102"/>
    </anomaly>
    <anomaly type="suspicious" value="1.242230,1.561400,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="92.230.142.116" dst_ip="186.30.103.236" src_port="80" dst_port="64931"/>
        </slice>
        <from usec="0" sec="1415682166"/>
        <to usec="0" sec="1415682168"/>
    </anomaly>
    <anomaly type="suspicious" value="1.242230,1.561400,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="114.176.251.156" dst_ip="214.133.93.17" src_port="993" dst_port="56457"/>
        </slice>
        <from usec="0" sec="1415682108"/>
        <to usec="0" sec="1415682246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.242230,1.561400,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="147.240.140.67" dst_ip="113.161.112.50" dst_port="80"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682378"/>
    </anomaly>
    <anomaly type="suspicious" value="1.242230,1.561400,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="147.240.151.98" dst_port="443"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682377"/>
    </anomaly>
    <anomaly type="suspicious" value="1.242230,1.561400,504,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="169.221.114.56" dst_ip="143.32.45.240" src_port="443"/>
        </slice>
        <from usec="0" sec="1415682091"/>
        <to usec="0" sec="1415682234"/>
    </anomaly>
    <anomaly type="suspicious" value="1.242230,1.561400,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="79.200.28.205" dst_ip="186.30.108.169" src_port="80"/>
        </slice>
        <from usec="0" sec="1415682401"/>
        <to usec="0" sec="1415682434"/>
    </anomaly>
    <anomaly type="suspicious" value="1.242230,1.561400,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="147.112.112.166" dst_ip="64.153.182.186" src_port="53261" dst_port="443"/>
            <filter src_ip="147.112.112.166" dst_ip="64.153.176.97" src_port="53052" dst_port="443"/>
            <filter src_ip="147.112.112.166" dst_ip="67.126.100.211" src_port="49241" dst_port="80"/>
        </slice>
        <from usec="0" sec="1415682021"/>
        <to usec="0" sec="1415682719"/>
    </anomaly>
    <anomaly type="suspicious" value="1.242230,1.561400,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="45.199.14.55" dst_ip="186.30.132.150" src_port="80" dst_port="59302"/>
        </slice>
        <from usec="0" sec="1415682636"/>
        <to usec="0" sec="1415682643"/>
    </anomaly>
    <anomaly type="suspicious" value="1.711860,1.869150,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682108"/>
    </anomaly>
    <anomaly type="suspicious" value="1.711860,1.869150,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682198"/>
    </anomaly>
    <anomaly type="suspicious" value="1.343240,1.606070,999,0 0 0 1 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="143.32.142.133" src_port="53"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682547"/>
    </anomaly>
    <anomaly type="suspicious" value="1.343240,1.606070,503,0 0 0 1 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="194.2.232.233" dst_ip="149.243.36.228" src_port="80"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682140"/>
    </anomaly>
    <anomaly type="suspicious" value="1.343240,1.606070,502,0 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.154.44.103" src_port="22"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682558"/>
    </anomaly>
    <anomaly type="suspicious" value="1.343240,1.606070,020,0 0 0 1 0 0 1 1 0 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="214.133.89.29"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682199"/>
    </anomaly>
    <anomaly type="suspicious" value="1.376040,1.549860,020,1 1 0 0 0 0 1 1 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="204.64.7.146"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="143.32.210.149" src_port="80"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.209950,1.413490,503,1 1 0 0 0 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="214.133.82.216" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="214.133.89.89" dst_port="53"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.343240,1.606070,999,0 0 0 1 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="149.243.169.94" src_port="53"/>
            <filter dst_ip="149.243.28.228" src_port="53"/>
            <filter dst_ip="186.30.130.62" src_port="53"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682377"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="143.32.183.205" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.435710,1.555810,010,1 1 0 1 0 0 1 1 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="214.133.90.214" dst_port="80"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682896"/>
    </anomaly>
    <anomaly type="suspicious" value="1.189550,1.525800,010,1 0 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="205.173.253.22" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1415682818"/>
        <to usec="0" sec="1415682901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.343240,1.606070,999,0 0 0 1 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="148.108.86.104" dst_ip="218.248.182.110" dst_port="53"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682103"/>
    </anomaly>
    <anomaly type="suspicious" value="1.343240,1.606070,999,0 0 0 1 0 0 1 1 0 0 0 0,rflatDNS">
        <slice>
            <filter dst_ip="147.240.228.148" src_port="53"/>
            <filter dst_ip="147.240.228.144" src_port="53"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682648"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,504,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="53.9.154.227" dst_ip="184.116.128.2" src_port="443"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="222.202.23.66" dst_ip="215.120.167.170" dst_port="53"/>
            <filter src_ip="74.216.164.171" dst_ip="215.120.167.170" dst_port="53"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="203.176.38.112"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="9.142.58.101"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="214.133.95.236" src_port="53"/>
            <filter dst_ip="214.133.95.236" dst_port="53"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="186.30.97.81" src_port="80"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="214.133.83.112" dst_ip="207.184.184.239"/>
            <filter src_ip="214.133.83.124" dst_ip="207.184.184.239"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,503,0 0 0 0 0 0 1 1 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="94.138.174.244" dst_ip="143.32.44.170" src_port="80"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="214.133.83.112" dst_ip="76.135.175.72"/>
            <filter src_ip="214.133.83.124" dst_ip="76.135.175.72"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,503,0 0 0 0 0 0 1 1 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="12.245.98.21" dst_ip="143.32.94.192" src_port="80"/>
            <filter src_ip="88.215.56.222" dst_ip="143.32.94.192" src_port="80"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="147.240.230.89" dst_port="53"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="149.243.125.47" src_port="53"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="186.30.97.81" dst_ip="89.47.138.161" dst_port="80"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.279260,1.600300,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="214.133.89.102" src_port="53"/>
            <filter dst_ip="214.133.89.102" dst_port="26123"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.994556,1.456520,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="94.180.0.237"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991844,1.417350,504,1 0 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="149.243.189.224" dst_port="80"/>
            <filter src_ip="149.243.189.224" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.994556,1.456520,503,0 0 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="147.112.9.231"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991844,1.417350,503,1 0 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="147.112.59.97" dst_port="80"/>
            <filter src_ip="147.112.59.97" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.994556,1.456520,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="50.106.205.164"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.505060,1.545800,999,1 1 1 0 0 0 0 0 0 1 0 0,ipv4gretun">
        <slice>
            <filter src_ip="214.133.94.126" dst_ip="210.25.1.213"/>
            <filter src_ip="214.133.94.126" dst_ip="209.180.182.32"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.994556,1.456520,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="9.166.155.200"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.994556,1.456520,504,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="117.13.63.230"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991844,1.417350,999,1 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="143.32.80.30" dst_port="995"/>
            <filter dst_ip="143.32.80.30" dst_port="20133"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.532570,1.606600,503,0 0 0 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="195.225.165.81" src_port="80"/>
            <filter dst_ip="147.112.126.227" src_port="80"/>
            <filter dst_ip="147.112.126.227" src_port="443"/>
            <filter dst_ip="147.112.115.242" src_port="80"/>
            <filter src_ip="195.225.165.81" dst_ip="147.112.115.242" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.098630,1.468620,999,0 0 0 0 0 0 1 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="143.32.142.70" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.994556,1.456520,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="19.135.7.184" dst_ip="143.32.99.2" src_port="80"/>
            <filter src_ip="19.135.7.185" dst_ip="143.32.99.2" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.994556,1.456520,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="179.19.65.191"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991844,1.417350,503,1 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="147.112.50.113" dst_ip="67.126.100.245" dst_port="80"/>
            <filter src_ip="147.112.50.113" dst_ip="215.244.213.229" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.094160,1.514150,010,1 0 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="205.172.225.25" dst_port="2222"/>
        </slice>
        <from usec="0" sec="1415682354"/>
        <to usec="0" sec="1415682502"/>
    </anomaly>
    <anomaly type="suspicious" value="0.994556,1.456520,502,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="218.171.45.90" dst_ip="214.133.85.168" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.994556,1.456520,999,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="214.133.91.154" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991844,1.417350,504,1 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="147.240.145.154" dst_ip="9.167.25.57" src_port="58369" dst_port="443"/>
            <filter src_ip="147.240.145.154" dst_ip="9.167.25.57" src_port="58367" dst_port="443"/>
            <filter src_ip="147.240.145.154" dst_ip="9.167.25.57" src_port="58366" dst_port="443"/>
            <filter src_ip="147.240.145.154" dst_ip="9.167.25.57" src_port="58365" dst_port="443"/>
            <filter src_ip="147.240.139.7" dst_ip="9.167.25.57" src_port="53636" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.994556,1.456520,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="45.193.208.143"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.612030,1.630230,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="53.87.141.238" dst_ip="186.30.193.144" src_port="443" dst_port="49591"/>
            <filter src_ip="53.87.141.238" dst_ip="186.30.193.144" src_port="443" dst_port="49590"/>
            <filter src_ip="53.87.141.238" dst_ip="186.30.193.144" src_port="443" dst_port="49589"/>
            <filter src_ip="53.87.141.238" dst_ip="186.30.193.144" src_port="443" dst_port="49588"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.612030,1.630230,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="147.240.253.66" dst_ip="66.238.170.176" src_port="51037" dst_port="8022"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.991844,1.417350,503,1 0 0 0 0 0 0 0 0 1 0 0,point_to_point">
        <slice>
            <filter src_ip="189.121.60.163" dst_ip="215.120.186.184" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.642910,1.595380,503,1 1 0 0 0 0 1 1 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="215.114.136.246" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.680360,1.567700,504,1 1 0 1 1 0 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="114.72.123.175" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.679570,2.123520,503,1 1 0 1 1 1 1 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="215.114.136.7" dst_port="80"/>
            <filter src_ip="215.114.136.7" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.638610,2.115170,503,1 1 0 1 1 1 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="147.240.231.114" dst_port="80"/>
            <filter src_ip="147.240.231.114" dst_port="443"/>
            <filter dst_ip="202.19.69.173" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.490800,2.631040,503,1 1 1 1 1 1 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="143.32.137.207" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.132390,1.947960,999,1 1 0 1 1 1 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="50.54.20.31" src_port="16403" dst_port="16385"/>
            <filter dst_ip="50.54.20.31" src_port="16403" dst_port="16384"/>
        </slice>
        <from usec="0" sec="1415682009"/>
        <to usec="0" sec="1415682558"/>
    </anomaly>
    <anomaly type="anomalous" value="3.341640,2.548610,503,1 1 0 1 1 1 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="215.114.136.7" src_port="80"/>
            <filter dst_ip="215.114.136.7" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.657060,2.126080,504,1 1 0 0 0 0 1 1 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="215.120.186.184" dst_port="443"/>
            <filter src_ip="215.120.186.184" dst_port="53"/>
            <filter src_ip="215.120.186.184" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.066930,1.813490,502,1 1 1 1 1 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.154.44.103" dst_port="22"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682612"/>
    </anomaly>
    <anomaly type="anomalous" value="2.066930,1.813490,011,1 1 1 1 1 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="214.133.83.113"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682900"/>
    </anomaly>
    <anomaly type="anomalous" value="7.620310,6.953050,999,1 1 1 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="215.120.167.170" dst_ip="118.246.30.212" src_port="53"/>
            <filter src_ip="215.120.167.170" dst_ip="222.202.23.66" src_port="53"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682901"/>
    </anomaly>
    <anomaly type="anomalous" value="2.380810,1.881800,503,1 1 0 1 1 0 1 1 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="143.32.137.103" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.023010,1.720790,503,1 1 1 0 0 0 1 0 0 1 1 0,point_to_point">
        <slice>
            <filter src_ip="114.97.244.165" dst_ip="143.32.210.176" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.559810,1.551780,010,1 1 1 1 0 0 0 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="166.238.223.31" src_port="6000" dst_port="48080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.567040,2.097650,010,1 1 1 1 1 1 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="81.90.64.154" src_port="6000" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.010600,1.715870,011,1 1 1 1 0 0 0 0 0 1 1 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="166.238.223.31" src_port="48080" dst_port="6000"/>
            <filter dst_ip="0.218.88.59" src_port="8088" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.679050,1.645000,999,1 1 1 1 1 0 0 0 0 0 0 0,ipv46tun">
        <slice>
            <filter src_ip="214.133.94.241" dst_ip="141.133.100.182"/>
            <filter src_ip="214.133.94.241" dst_ip="166.238.223.31" src_port="48080" dst_port="6000"/>
            <filter src_ip="214.111.175.198" dst_ip="141.133.100.182"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682886"/>
    </anomaly>
    <anomaly type="anomalous" value="2.574110,2.089130,010,1 1 1 0 0 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="0.218.88.59" src_port="6000" dst_port="8088"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.276070,2.517870,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="81.90.64.129" src_port="6000" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.066930,1.813490,010,1 1 1 1 1 0 1 1 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="214.133.83.113" dst_port="80"/>
            <filter dst_ip="214.133.90.201" dst_port="80"/>
        </slice>
        <from usec="0" sec="1415682000"/>
        <to usec="0" sec="1415682901"/>
    </anomaly>
    <anomaly type="anomalous" value="3.074280,2.441110,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="1.58.143.204" src_port="80"/>
            <filter src_ip="53.104.61.180" src_port="80"/>
            <filter dst_ip="186.30.126.129" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.071260,1.988330,504,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="186.30.27.40" src_port="80"/>
            <filter src_ip="67.126.98.252" dst_ip="186.30.27.40" src_port="443"/>
        </slice>
        <from usec="0" sec="1415682008"/>
        <to usec="0" sec="1415682174"/>
    </anomaly>
    <anomaly type="anomalous" value="2.071260,1.988330,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="147.240.231.34" dst_ip="61.128.195.145" src_port="80" dst_port="53469"/>
            <filter src_ip="147.240.231.34" dst_ip="61.128.195.145" src_port="80" dst_port="39144"/>
        </slice>
        <from usec="0" sec="1415682613"/>
        <to usec="0" sec="1415682638"/>
    </anomaly>
    <anomaly type="anomalous" value="3.074280,2.441110,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="214.133.94.189" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.257380,2.024020,503,0 0 0 1 1 1 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="1.58.143.133" dst_ip="215.114.136.7" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.071260,1.988330,504,0 0 0 1 1 1 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="50.54.21.194" dst_port="443"/>
        </slice>
        <from usec="0" sec="1415682001"/>
        <to usec="0" sec="1415682558"/>
    </anomaly>
    <anomaly type="anomalous" value="3.116660,2.431600,504,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter src_ip="82.202.124.91" dst_ip="215.114.136.7" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.302970,2.579590,503,0 0 0 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="215.114.136.246" src_port="80"/>
            <filter dst_ip="215.120.186.184" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.598900,2.111980,503,1 0 0 0 1 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="215.120.186.184" src_port="80"/>
            <filter dst_ip="215.120.186.184" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.639200,2.141270,503,1 0 0 1 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="92.226.214.93" src_port="80"/>
            <filter dst_ip="149.243.25.183" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.689860,1.580740,504,1 1 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="186.30.192.164" dst_ip="50.9.14.202" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.369040,2.012470,999,0 1 0 0 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="210.25.1.213" dst_ip="214.133.94.126"/>
            <filter src_ip="209.180.182.32" dst_ip="214.133.94.126"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.380810,1.881800,504,1 1 0 1 1 0 1 1 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="92.226.211.3" src_port="80"/>
            <filter src_ip="92.226.211.3" src_port="443"/>
            <filter dst_ip="149.243.25.183" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.863420,2.221780,010,1 1 1 1 1 1 1 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="81.90.64.69" src_port="6000" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.311840,1.995950,503,1 0 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="214.133.82.216" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.616090,2.097590,010,1 1 1 0 0 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="37.83.13.59" src_port="12200" dst_port="80"/>
            <filter src_ip="37.83.13.59" src_port="12200" dst_port="3128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.348990,2.028520,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="215.114.139.115" src_port="443"/>
            <filter src_ip="172.17.148.228" dst_ip="215.114.139.115" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.689860,1.580740,504,1 1 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="53.85.94.130" dst_port="443"/>
            <filter dst_ip="9.160.199.147" dst_port="443"/>
            <filter src_ip="147.240.148.187" dst_ip="67.126.101.112" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.689860,1.580740,504,1 1 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="215.114.139.38" dst_ip="53.85.83.54"/>
            <filter src_ip="215.114.139.38" dst_port="443"/>
            <filter src_ip="149.243.23.199" dst_ip="53.85.83.54" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.689860,1.580740,504,1 1 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="149.243.23.199" dst_port="443"/>
            <filter src_ip="149.243.77.11" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.688450,2.130420,503,1 1 0 1 0 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="214.133.94.189" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.075160,2.464060,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter dst_ip="215.114.136.7" src_port="80"/>
            <filter dst_ip="186.30.14.88" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.678240,1.641050,503,0 0 0 0 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="143.32.100.78" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.276070,2.517870,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="88.44.28.225" src_port="12200" dst_port="3128"/>
            <filter src_ip="88.44.28.225" src_port="12200" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.663260,1.635890,503,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="143.32.46.79" src_port="80"/>
            <filter src_ip="92.239.220.251" dst_ip="143.32.46.4" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.313000,2.023950,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="186.30.194.36" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
