<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.138500,1.506140,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="122.145.82.183" dst_ip="154.68.124.195" src_port="80"/>
        </slice>
        <from usec="0" sec="1418360409"/>
        <to usec="0" sec="1418360410"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="197.143.53.218" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360446"/>
        <to usec="0" sec="1418360458"/>
    </anomaly>
    <anomaly type="suspicious" value="1.253190,1.428400,504,1 1 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="173.209.111.154" dst_ip="8.164.101.139" dst_port="443"/>
            <filter src_ip="170.157.158.236" dst_ip="8.164.101.139" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.253190,1.428400,504,1 1 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="170.157.96.156" dst_ip="47.135.40.29" dst_port="443"/>
            <filter src_ip="170.157.96.156" dst_ip="47.135.40.76" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="122.145.80.121" dst_ip="173.209.4.218" src_port="80" dst_port="53387"/>
        </slice>
        <from usec="0" sec="1418360462"/>
        <to usec="0" sec="1418361126"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="154.68.109.30" dst_port="80"/>
        </slice>
        <from usec="0" sec="1418360404"/>
        <to usec="0" sec="1418361298"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="81.181.182.114" dst_ip="212.141.195.216" src_port="15471" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1418360936"/>
        <to usec="0" sec="1418360943"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,504,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="170.157.98.142" dst_port="443"/>
        </slice>
        <from usec="0" sec="1418360406"/>
        <to usec="0" sec="1418360856"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="127.144.193.171" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1418360536"/>
        <to usec="0" sec="1418360665"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="2.225.190.83" src_port="6000" dst_port="22"/>
        </slice>
        <from usec="0" sec="1418360817"/>
        <to usec="0" sec="1418360819"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="62.218.13.119" src_port="12200" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1418361199"/>
        <to usec="0" sec="1418361293"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,503,1 1 1 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="180.85.221.11" src_port="80"/>
        </slice>
        <from usec="0" sec="1418361015"/>
        <to usec="0" sec="1418361054"/>
    </anomaly>
    <anomaly type="suspicious" value="1.359630,1.528450,020,1 1 1 1 0 0 1 0 0 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="146.155.114.69"/>
        </slice>
        <from usec="0" sec="1418360486"/>
        <to usec="0" sec="1418360896"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="197.24.42.248" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1418361137"/>
        <to usec="0" sec="1418361271"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.229.197.81" src_port="37655" dst_port="1202"/>
        </slice>
        <from usec="0" sec="1418361147"/>
        <to usec="0" sec="1418361148"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.229.197.84" src_port="21651" dst_port="1336"/>
        </slice>
        <from usec="0" sec="1418360457"/>
        <to usec="0" sec="1418360458"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.229.197.65" src_port="31759" dst_port="2164"/>
        </slice>
        <from usec="0" sec="1418360542"/>
        <to usec="0" sec="1418360543"/>
    </anomaly>
    <anomaly type="suspicious" value="1.306180,1.534580,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.55.70.45" src_port="12200" dst_port="80"/>
        </slice>
        <from usec="0" sec="1418360940"/>
        <to usec="0" sec="1418361291"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="201.191.181.212" src_port="26336" dst_port="22"/>
        </slice>
        <from usec="0" sec="1418361278"/>
        <to usec="0" sec="1418361279"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="18.164.42.197" src_port="12200" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1418361282"/>
        <to usec="0" sec="1418361299"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="219.198.157.49" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360462"/>
        <to usec="0" sec="1418360478"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199450,1.499900,010,1 1 1 1 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="84.250.46.28" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418361038"/>
        <to usec="0" sec="1418361050"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="62.75.109.208" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418361241"/>
        <to usec="0" sec="1418361252"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="127.115.85.140" dst_port="22"/>
        </slice>
        <from usec="0" sec="1418361209"/>
        <to usec="0" sec="1418361215"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="38.161.241.170" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418361095"/>
        <to usec="0" sec="1418361106"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="143.133.66.123" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418361134"/>
        <to usec="0" sec="1418361142"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.167.121.210" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360923"/>
        <to usec="0" sec="1418360950"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="80.236.110.108" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360769"/>
        <to usec="0" sec="1418360780"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="3.35.157.225" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360481"/>
        <to usec="0" sec="1418360492"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="88.174.200.83" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360556"/>
        <to usec="0" sec="1418360569"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="196.119.62.218" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418361108"/>
        <to usec="0" sec="1418361119"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="142.218.38.130" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418360411"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="4.105.17.71" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418361217"/>
        <to usec="0" sec="1418361229"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.165.117.63" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418361161"/>
        <to usec="0" sec="1418361174"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="86.16.52.158" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360486"/>
        <to usec="0" sec="1418360497"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="140.105.216.0" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360851"/>
        <to usec="0" sec="1418360862"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="86.93.86.204" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418361171"/>
        <to usec="0" sec="1418361184"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.22.199.107" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360646"/>
        <to usec="0" sec="1418360657"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="31.87.157.234" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360435"/>
        <to usec="0" sec="1418360447"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="81.245.6.225" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418361197"/>
        <to usec="0" sec="1418361207"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="66.223.32.242" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360771"/>
        <to usec="0" sec="1418360795"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="82.97.118.188" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418361175"/>
        <to usec="0" sec="1418361188"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="86.188.42.85" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360413"/>
        <to usec="0" sec="1418360424"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="62.212.190.100" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418361219"/>
        <to usec="0" sec="1418361231"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="145.132.182.175" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360602"/>
        <to usec="0" sec="1418360608"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.100.36.205" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360939"/>
        <to usec="0" sec="1418360951"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="197.34.188.47" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360940"/>
        <to usec="0" sec="1418360953"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="140.191.150.69" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418361218"/>
        <to usec="0" sec="1418361219"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="90.206.14.66" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1418360401"/>
        <to usec="0" sec="1418361047"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="143.128.106.141" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360652"/>
        <to usec="0" sec="1418360664"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="89.181.147.232" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418361161"/>
        <to usec="0" sec="1418361173"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138500,1.506140,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="145.132.182.175"/>
        </slice>
        <from usec="0" sec="1418360602"/>
        <to usec="0" sec="1418360608"/>
    </anomaly>
    <anomaly type="suspicious" value="1.306180,1.534580,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="18.164.43.66" src_port="12200" dst_port="1998"/>
        </slice>
        <from usec="0" sec="1418360580"/>
        <to usec="0" sec="1418361049"/>
    </anomaly>
    <anomaly type="suspicious" value="1.306180,1.534580,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="222.216.11.15" src_port="5068" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418360688"/>
    </anomaly>
    <anomaly type="suspicious" value="1.153090,1.528670,504,0 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="47.190.136.145" dst_ip="173.106.120.140" src_port="443"/>
        </slice>
        <from usec="0" sec="1418360402"/>
        <to usec="0" sec="1418360657"/>
    </anomaly>
    <anomaly type="suspicious" value="1.033710,1.525170,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="212.141.202.142" dst_ip="212.141.202.142"/>
        </slice>
        <from usec="0" sec="1418360451"/>
        <to usec="0" sec="1418360877"/>
    </anomaly>
    <anomaly type="suspicious" value="1.306180,1.534580,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.55.64.234" src_port="12200" dst_port="1080"/>
        </slice>
        <from usec="0" sec="1418361075"/>
        <to usec="0" sec="1418361266"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="4.184.189.248" dst_ip="173.209.2.4" dst_port="8457"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418360597"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="62.51.251.106" dst_ip="180.85.245.52" src_port="5163" dst_port="44739"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418360688"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,012,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="99.249.104.59" dst_ip="180.85.3.123" src_port="6969"/>
        </slice>
        <from usec="0" sec="1418360404"/>
        <to usec="0" sec="1418360679"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="206.183.150.103" dst_ip="212.141.197.15" src_port="80"/>
        </slice>
        <from usec="0" sec="1418360489"/>
        <to usec="0" sec="1418360515"/>
    </anomaly>
    <anomaly type="suspicious" value="1.160590,1.461400,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418360778"/>
    </anomaly>
    <anomaly type="suspicious" value="1.160590,1.461400,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418361228"/>
    </anomaly>
    <anomaly type="suspicious" value="1.378180,1.484380,020,0 0 0 1 1 0 1 0 0 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="92.6.247.123"/>
        </slice>
        <from usec="0" sec="1418360402"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="187.177.207.4" dst_port="53"/>
        </slice>
        <from usec="0" sec="1418360402"/>
        <to usec="0" sec="1418360954"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="213.107.129.215" dst_ip="41.192.83.95" dst_port="443"/>
        </slice>
        <from usec="0" sec="1418360402"/>
        <to usec="0" sec="1418360955"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="199.151.170.135" dst_ip="212.141.202.175" dst_port="80"/>
        </slice>
        <from usec="0" sec="1418360421"/>
        <to usec="0" sec="1418360926"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="0.100.170.78" dst_ip="212.141.197.6" src_port="80"/>
        </slice>
        <from usec="0" sec="1418360909"/>
        <to usec="0" sec="1418360919"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="83.206.48.206" dst_ip="180.85.184.144" dst_port="59265"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418361047"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="173.209.109.173" dst_ip="12.185.160.234" dst_port="443"/>
            <filter src_ip="173.209.109.173" dst_ip="79.53.192.39" dst_port="80"/>
        </slice>
        <from usec="0" sec="1418360402"/>
        <to usec="0" sec="1418361044"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,999,0 0 0 1 1 0 0 0 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="133.137.173.138" dst_ip="212.141.209.147" src_port="53"/>
        </slice>
        <from usec="0" sec="1418360403"/>
        <to usec="0" sec="1418361048"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="154.68.137.124" dst_ip="160.53.95.34" dst_port="80"/>
            <filter src_ip="154.68.137.124" dst_ip="160.53.64.233" dst_port="80"/>
        </slice>
        <from usec="0" sec="1418360405"/>
        <to usec="0" sec="1418361132"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="170.157.26.7" dst_ip="12.136.82.1" src_port="993" dst_port="33329"/>
            <filter src_ip="170.157.26.7" dst_ip="12.136.82.71" src_port="993" dst_port="54531"/>
        </slice>
        <from usec="0" sec="1418360404"/>
        <to usec="0" sec="1418361135"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="122.145.83.107" dst_ip="154.68.18.129" src_port="80"/>
            <filter src_ip="122.145.83.107" dst_ip="154.68.163.249" src_port="80"/>
        </slice>
        <from usec="0" sec="1418360735"/>
        <to usec="0" sec="1418361126"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,504,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="41.204.194.192" dst_ip="173.209.1.85" src_port="443"/>
        </slice>
        <from usec="0" sec="1418360793"/>
        <to usec="0" sec="1418361102"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="47.163.250.6" dst_ip="154.68.204.51" src_port="443" dst_port="50301"/>
        </slice>
        <from usec="0" sec="1418361053"/>
        <to usec="0" sec="1418361189"/>
    </anomaly>
    <anomaly type="suspicious" value="1.745150,1.811790,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418360778"/>
    </anomaly>
    <anomaly type="suspicious" value="1.745150,1.811790,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418360778"/>
    </anomaly>
    <anomaly type="suspicious" value="1.134290,1.492120,020,1 0 0 0 0 0 1 1 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="84.52.80.176"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.954070,1.977700,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="212.141.210.57" dst_port="53"/>
        </slice>
        <from usec="0" sec="1418360850"/>
        <to usec="0" sec="1418360941"/>
    </anomaly>
    <anomaly type="suspicious" value="1.209360,1.508660,999,0 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="173.205.10.135" dst_port="22921"/>
            <filter dst_ip="173.205.10.135" dst_port="4605"/>
            <filter dst_ip="173.205.10.135" dst_port="16894"/>
        </slice>
        <from usec="0" sec="1418360402"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,010,0 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="88.12.13.120" dst_ip="154.68.103.232" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.954070,1.977700,999,0 0 0 0 0 0 1 1 1 0 0 0,rflatDNS">
        <slice>
            <filter dst_ip="170.157.191.39" src_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,020,0 0 0 0 0 0 1 1 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="173.209.53.31"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="222.53.64.2" dst_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,rflatDNS">
        <slice>
            <filter dst_ip="173.198.230.60" src_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.954070,1.977700,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="180.85.78.238" src_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="170.157.191.40" src_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.954070,1.977700,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="170.157.80.29" src_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,rflatDNS">
        <slice>
            <filter dst_ip="170.157.9.140" src_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="170.157.46.236" src_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.209.48.163" src_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.954070,1.977700,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.106.67.181" src_port="53"/>
            <filter dst_ip="173.106.67.181" dst_port="63000"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.954070,1.977700,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="116.51.96.170" dst_ip="212.141.205.42" dst_port="53"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.209.48.164" src_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.209360,1.508660,999,0 0 0 1 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="213.107.154.196" src_port="53"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.954070,1.977700,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.209.48.165" src_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="116.51.96.170" dst_ip="213.107.154.197" dst_port="53"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.209.48.166" src_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="129.119.202.202" dst_ip="153.106.242.196" src_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="116.51.96.170" dst_ip="213.102.126.127" dst_port="53"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.954070,1.977700,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="180.85.6.69" src_port="80"/>
            <filter dst_ip="180.85.6.69" dst_port="54286"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.209.51.6" src_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,020,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="212.141.205.56"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,010,0 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="201.26.103.108" dst_ip="173.88.80.83" dst_port="7"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="193.8.41.28"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.209360,1.508660,999,0 0 0 1 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="154.68.135.218" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1418360418"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,010,0 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="212.141.205.42" dst_ip="192.168.114.56" dst_port="80"/>
            <filter src_ip="212.141.205.42" dst_ip="192.168.114.56" dst_port="81"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="212.141.203.207" src_port="53"/>
            <filter dst_ip="212.141.203.207" dst_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="212.141.203.203" dst_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="212.141.203.200" dst_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,020,0 0 0 0 0 0 1 1 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="170.157.63.13"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,020,0 0 0 0 0 0 1 1 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="212.141.203.180"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.954070,1.977700,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="129.76.123.219"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="212.141.196.59" dst_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="173.198.230.121" src_port="443"/>
            <filter dst_ip="173.198.230.121" src_port="80"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,503,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="213.103.229.120" dst_ip="173.209.106.3" src_port="80"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.209.119.218" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.954070,1.977700,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="212.141.210.57" dst_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="180.85.100.194" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="212.141.199.105" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.134290,1.492120,999,1 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="212.141.205.42" dst_ip="116.51.96.170" src_port="53"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.209.51.109" dst_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.954070,1.977700,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="213.243.54.154" dst_ip="10.242.45.121" src_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="89.164.57.111"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,054,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="41.196.74.35" dst_ip="180.85.7.162" src_port="443"/>
            <filter src_ip="41.196.74.53" dst_ip="180.85.7.162" src_port="443"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="154.68.136.137" dst_port="19835"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="134.222.101.160"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="116.51.96.170" dst_ip="173.88.116.81" dst_port="53"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="146.169.220.126" dst_ip="170.157.96.83" src_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.209.35.41" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.954070,1.977700,010,0 0 0 0 0 0 1 1 1 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="201.26.103.108" dst_ip="173.205.16.249" dst_port="7"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="212.141.206.84" dst_port="53"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="173.209.248.122" src_port="3389"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.954070,1.977700,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="27.130.59.59" dst_ip="212.141.204.230" dst_port="53"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="116.51.96.170" dst_ip="212.141.205.174" dst_port="53"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.209.195.236" dst_port="17832"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025980,1.479720,020,0 0 0 1 0 0 0 1 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="173.209.53.31"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="213.107.158.190" dst_port="64644"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148940,1.514860,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="88.185.118.195"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.954070,1.977700,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="212.141.206.108" dst_port="26123"/>
            <filter dst_ip="212.141.206.108" dst_port="27045"/>
        </slice>
        <from usec="0" sec="1418360625"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.144300,1.424660,503,1 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="173.209.4.126" dst_ip="80.255.245.165" dst_port="80"/>
            <filter src_ip="173.209.4.126" dst_ip="4.151.127.33" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158820,1.448450,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="173.209.122.240"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.144300,1.424660,504,1 0 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="154.68.11.221" src_port="9358"/>
            <filter src_ip="154.68.11.221" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158820,1.448450,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="198.105.156.195"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.144300,1.424660,504,1 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="173.209.111.154" src_port="443"/>
            <filter dst_ip="173.209.111.154" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.206660,1.431280,504,1 0 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="34.232.208.88" src_port="443"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418361048"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158820,1.448450,504,0 0 0 0 0 0 0 0 0 1 0 0,salphfl">
        <slice>
            <filter dst_ip="85.160.163.69"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158820,1.448450,503,0 0 0 0 0 0 0 0 0 1 0 0,malphfl">
        <slice>
            <filter src_ip="2.252.121.178" dst_ip="154.68.11.39" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.218750,1.441960,503,0 0 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="154.68.10.217" src_port="80"/>
            <filter dst_ip="154.68.10.217" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.220440,1.454960,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="155.43.61.223" dst_ip="173.209.108.27" src_port="80"/>
        </slice>
        <from usec="0" sec="1418360428"/>
        <to usec="0" sec="1418361040"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158820,1.448450,502,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="83.34.163.155" dst_ip="212.141.207.67" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158820,1.448450,999,0 0 0 0 0 0 0 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="212.141.206.185" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158820,1.448450,502,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="221.212.146.166" dst_ip="212.141.204.15" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158820,1.448450,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="11.172.10.230"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.158820,1.448450,999,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="12.241.225.185"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.306180,1.534580,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="98.140.51.238" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1418360418"/>
        <to usec="0" sec="1418361266"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199450,1.499900,010,1 1 1 1 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.22.48.131" src_port="6000" dst_port="8026"/>
        </slice>
        <from usec="0" sec="1418360837"/>
        <to usec="0" sec="1418360859"/>
    </anomaly>
    <anomaly type="anomalous" value="2.046540,1.695810,999,1 1 1 0 0 0 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="212.141.202.142" dst_ip="208.189.13.198"/>
            <filter src_ip="212.141.202.142" dst_ip="210.234.65.44"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.431290,2.457540,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="89.166.179.2" src_port="6000" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.431290,2.457540,999,1 1 1 1 1 1 0 0 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="146.155.114.69" src_port="50717" dst_port="1900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.599850,2.023170,503,1 1 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="212.141.202.1" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.217700,2.062350,010,1 1 1 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="89.167.214.136" dst_port="80"/>
        </slice>
        <from usec="0" sec="1418361255"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="anomalous" value="3.431290,2.457540,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="91.153.69.18" src_port="9090" dst_port="22"/>
            <filter src_ip="2.225.190.89" src_port="6000" dst_port="22"/>
            <filter src_ip="84.213.167.159" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.609130,1.568100,010,1 1 1 1 1 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="88.176.231.245" dst_port="23"/>
        </slice>
        <from usec="0" sec="1418360998"/>
        <to usec="0" sec="1418361051"/>
    </anomaly>
    <anomaly type="anomalous" value="1.562910,1.562050,999,1 1 1 0 0 0 0 0 0 1 0 0,ipv46tun">
        <slice>
            <filter src_ip="212.141.202.114" dst_ip="183.65.54.91"/>
            <filter src_ip="212.141.202.114" dst_ip="2.225.190.89" src_port="22" dst_port="6000"/>
            <filter src_ip="212.141.202.114" dst_ip="105.134.234.207" src_port="5900" dst_port="53672"/>
            <filter src_ip="212.141.202.114" dst_ip="84.213.167.159" src_port="1433" dst_port="6000"/>
            <filter src_ip="212.43.105.206" dst_ip="183.65.54.91"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.682790,2.002990,504,1 0 0 1 1 1 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="170.157.40.163" dst_ip="47.133.136.144" src_port="49583" dst_port="443"/>
            <filter src_ip="170.157.40.163" dst_ip="47.133.136.144" src_port="49582" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.689020,2.019990,503,0 0 0 1 1 1 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="154.68.135.178" src_port="80"/>
            <filter src_ip="79.53.195.116" dst_ip="154.68.135.178" src_port="443"/>
            <filter src_ip="79.53.192.163" dst_ip="154.68.135.178" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.082950,1.863610,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="154.68.11.156" src_port="80"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418360595"/>
    </anomaly>
    <anomaly type="anomalous" value="2.082950,1.863610,999,0 0 0 1 1 1 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.88.35.219" dst_port="38149"/>
        </slice>
        <from usec="0" sec="1418360411"/>
        <to usec="0" sec="1418360598"/>
    </anomaly>
    <anomaly type="anomalous" value="2.074910,1.845180,504,1 0 0 1 1 1 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="170.157.92.146" dst_port="443"/>
        </slice>
        <from usec="0" sec="1418360413"/>
        <to usec="0" sec="1418361141"/>
    </anomaly>
    <anomaly type="anomalous" value="2.342050,1.909080,503,0 0 0 1 1 1 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="154.68.79.44" src_port="80"/>
            <filter dst_ip="154.68.79.44" src_port="443"/>
            <filter dst_ip="154.68.209.25" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.427220,1.775580,503,1 1 1 1 1 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="180.85.73.34" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.267100,2.386940,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="129.43.44.202" src_port="80"/>
            <filter dst_ip="213.107.141.201" src_port="80"/>
            <filter dst_ip="213.107.141.201" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.181310,1.655990,504,1 0 0 1 1 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="146.148.13.22" dst_port="443"/>
            <filter dst_ip="146.148.13.22" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.261980,2.372580,010,1 0 0 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="193.8.41.17" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.217700,2.062350,020,1 1 1 0 0 0 1 1 1 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="222.216.11.15"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418360687"/>
    </anomaly>
    <anomaly type="anomalous" value="2.310650,2.010990,504,1 1 0 1 1 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="115.89.58.141" dst_port="443"/>
            <filter dst_ip="115.89.58.141" dst_port="80"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="anomalous" value="1.606160,1.554640,999,1 0 0 1 1 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="180.85.246.180" dst_port="10628"/>
        </slice>
        <from usec="0" sec="1418360405"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="anomalous" value="2.310650,2.010990,010,1 1 0 1 1 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="212.141.197.14" dst_port="80"/>
            <filter dst_ip="212.141.197.15" dst_port="80"/>
            <filter dst_ip="212.141.205.43" dst_port="80"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="anomalous" value="3.923750,2.832730,503,1 1 1 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="180.85.73.255" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.310650,2.010990,504,1 1 0 1 1 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="115.89.60.17" dst_port="443"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="anomalous" value="2.644800,2.018180,502,1 1 1 1 1 1 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="212.141.196.41" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.685470,1.558070,504,1 1 0 1 1 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="115.89.62.241" dst_port="443"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="anomalous" value="2.832920,2.107790,503,1 1 0 1 0 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="212.141.202.1" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.260860,2.025280,999,0 0 0 1 1 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="180.85.77.35" src_port="53"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="anomalous" value="1.990190,1.972950,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="154.68.203.196" src_port="53"/>
        </slice>
        <from usec="0" sec="1418360400"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="anomalous" value="2.546690,2.053200,502,1 1 0 1 1 0 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="212.141.196.41" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.990190,1.972950,020,0 0 0 1 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="193.8.41.17"/>
            <filter dst_ip="193.8.41.0"/>
            <filter dst_ip="2.233.45.245"/>
        </slice>
        <from usec="0" sec="1418360401"/>
        <to usec="0" sec="1418361301"/>
    </anomaly>
    <anomaly type="anomalous" value="2.991400,2.170180,503,0 0 0 1 1 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="83.18.255.142" src_port="80"/>
            <filter dst_ip="173.209.229.235" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.821020,1.573550,504,1 1 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="173.209.42.110" dst_ip="8.164.182.216"/>
            <filter src_ip="173.209.42.110" dst_port="443"/>
            <filter dst_ip="8.164.182.216" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.394360,1.742090,503,1 1 0 1 1 0 1 1 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="213.107.64.162" dst_port="80"/>
            <filter src_ip="213.107.64.162" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.261980,2.372580,020,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="140.85.14.35" src_port="1723"/>
            <filter dst_ip="99.97.213.165"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.747870,1.570160,503,1 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="170.157.4.158" src_port="80"/>
            <filter dst_ip="170.157.4.158" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.757410,1.591780,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="180.85.246.202" src_port="80"/>
            <filter dst_ip="180.85.246.202" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.757410,1.591780,503,0 0 0 0 0 0 0 0 0 1 1 0,point_to_point">
        <slice>
            <filter src_ip="140.92.134.205" dst_ip="180.85.47.112" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.835730,2.139950,010,1 1 1 0 0 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="62.208.130.153" src_port="12200" dst_port="1080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.434770,2.462890,999,0 0 0 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.34.127.233" src_port="53"/>
            <filter dst_ip="213.102.95.237" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.859730,1.567580,504,1 1 0 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="170.157.158.210" dst_port="443"/>
            <filter src_ip="170.157.158.210" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.431290,2.457540,503,1 1 1 1 1 1 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="170.157.203.68" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.757410,1.591780,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="83.75.126.11" dst_ip="213.107.129.63" src_port="80" dst_port="58847"/>
            <filter src_ip="83.75.126.11" dst_ip="213.107.129.14" src_port="80" dst_port="64674"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.555700,2.037380,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="140.176.179.5" dst_ip="213.107.128.44" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.757410,1.591780,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="34.232.208.65" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.757410,1.591780,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="120.89.226.33" dst_ip="180.85.246.189" src_port="443" dst_port="63977"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.923750,2.832730,504,1 1 1 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="83.18.249.234" src_port="443"/>
            <filter dst_ip="170.157.13.84" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.757410,1.591780,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="118.156.133.240" dst_ip="173.209.86.244" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.490510,2.475070,999,1 1 1 1 1 1 1 0 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="219.71.57.80" src_port="47017" dst_port="19"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.591310,2.531370,999,1 1 1 1 1 1 1 1 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="27.38.65.107" src_port="55365" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.886290,2.102940,010,1 1 1 1 1 1 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="89.166.188.215" src_port="6000" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.797490,1.585870,504,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="122.145.82.175" src_port="443"/>
            <filter src_ip="122.145.82.175" src_port="80"/>
            <filter dst_ip="154.68.204.1" src_port="443"/>
            <filter dst_ip="154.68.204.1" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.416780,2.503700,503,1 1 0 1 1 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="213.107.64.162" src_port="80"/>
            <filter dst_ip="213.107.64.162" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.416780,2.503700,503,1 1 0 1 1 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="213.102.103.157" src_port="80"/>
            <filter dst_ip="213.102.103.157" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.886290,2.102940,010,1 1 1 1 1 1 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="140.85.14.35" dst_port="1723"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.731010,2.005660,504,1 1 0 1 1 1 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="170.157.169.242" dst_port="443"/>
            <filter src_ip="170.157.169.241" dst_port="443"/>
            <filter src_ip="170.157.169.241" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.837670,2.069710,504,1 1 0 1 1 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="170.157.13.84" dst_port="443"/>
            <filter src_ip="170.157.13.84" dst_port="80"/>
            <filter src_ip="170.157.41.11" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
