<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="2.642450,2.689230,011,1 1 1 1 1 1 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="214.182.35.20"/>
            <filter src_ip="214.182.40.188"/>
        </slice>
        <from usec="0" sec="1420088400"/>
        <to usec="0" sec="1420089301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.833110,2.442940,999,1 1 1 0 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="214.182.44.181" dst_ip="209.123.132.131"/>
            <filter src_ip="214.182.44.181" dst_ip="210.188.197.102"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.754420,2.440490,503,1 1 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="139.75.189.251" src_port="80"/>
            <filter dst_ip="139.75.189.251" dst_port="2482"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.204930,2.487140,504,1 1 1 1 1 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="148.91.245.140" src_port="443"/>
            <filter src_ip="93.180.59.251" dst_ip="148.91.245.140" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.754420,2.440490,503,1 1 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="144.192.206.4" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.279230,2.504920,010,1 1 1 1 1 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="214.182.35.20"/>
            <filter dst_ip="214.182.40.165"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.655830,2.440570,010,1 1 1 1 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="214.182.40.188"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.782010,2.560850,010,1 0 0 1 1 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="117.110.205.190" dst_port="23"/>
        </slice>
        <from usec="0" sec="1420089076"/>
        <to usec="0" sec="1420089095"/>
    </anomaly>
    <anomaly type="suspicious" value="1.853710,2.670960,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1420088400"/>
        <to usec="0" sec="1420088688"/>
    </anomaly>
    <anomaly type="suspicious" value="1.853710,2.670960,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1420088400"/>
        <to usec="0" sec="1420089228"/>
    </anomaly>
    <anomaly type="suspicious" value="1.754420,2.440490,999,1 1 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="214.182.37.27"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.888040,2.443250,503,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="215.201.161.52"/>
            <filter dst_ip="121.0.61.205" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.846930,2.458610,503,1 1 0 0 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="214.182.44.122" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.754420,2.440490,503,1 1 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="11.49.135.170" dst_ip="182.123.148.182" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.921290,2.477010,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="144.192.51.220" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.921290,2.477010,504,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="124.38.87.157" src_port="80"/>
            <filter src_ip="124.38.87.157" src_port="443"/>
            <filter dst_ip="144.192.211.229" src_port="80"/>
            <filter dst_ip="144.192.211.229" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.058890,2.446630,010,1 1 1 1 0 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="223.34.95.196" src_port="19710" dst_port="4082"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.642450,2.689230,010,1 1 1 1 1 1 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="97.30.167.51" src_port="12200" dst_port="443"/>
            <filter src_ip="97.30.167.51" src_port="12200" dst_port="80"/>
        </slice>
        <from usec="0" sec="1420088567"/>
        <to usec="0" sec="1420088959"/>
    </anomaly>
    <anomaly type="suspicious" value="1.773640,2.491240,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="182.123.115.11" src_port="80"/>
            <filter dst_ip="182.123.115.11" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.773640,2.491240,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="111.127.136.197" dst_ip="144.192.51.10" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.773640,2.491240,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="61.127.173.206" dst_ip="182.123.66.210" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.865190,2.509000,503,0 0 0 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="61.98.98.203" src_port="80"/>
            <filter dst_ip="182.123.115.11" src_port="80"/>
            <filter dst_ip="182.123.115.11" src_port="443"/>
            <filter dst_ip="182.123.10.199" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.773640,2.491240,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="55.40.27.152" dst_ip="182.123.67.75" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.737560,2.457680,999,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="214.182.37.14" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.921290,2.477010,999,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="133.147.144.151"/>
            <filter dst_ip="214.182.40.117" dst_port="36979"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.921290,2.477010,503,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="215.200.102.58" src_port="80"/>
            <filter dst_ip="215.201.139.102" src_port="53"/>
            <filter dst_ip="215.201.139.102" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.737560,2.457680,999,1 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="214.182.37.48" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.773640,2.491240,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="214.182.41.104" dst_ip="95.193.132.213" src_port="80"/>
            <filter src_ip="214.182.41.104" dst_ip="174.93.21.119" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.134450,2.638500,503,1 1 1 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="139.75.194.185" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="11.097700,8.892260,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="111.156.40.65" src_port="9090" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.080850,2.621630,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="196.138.177.1" src_port="9090" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.586910,2.510820,010,1 1 1 1 1 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="5.233.95.167" src_port="6000" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.531760,2.508440,503,1 1 0 1 1 0 1 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="219.118.235.162" dst_ip="214.182.34.68" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.134450,2.638500,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="33.148.190.161" src_port="12200" dst_port="1998"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.134450,2.638500,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="31.225.143.169" src_port="12200" dst_port="3128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.045840,2.666700,503,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="88.60.19.108" dst_ip="139.75.228.16" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.080850,2.621630,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="48.161.151.89" src_port="6000" dst_port="4899"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.034690,2.619340,503,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="214.182.44.122" src_port="80"/>
            <filter src_ip="214.182.34.68" dst_ip="219.118.235.162" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.045840,2.666700,999,0 0 0 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="214.182.37.27" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.100050,2.683290,010,0 0 0 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="5.184.53.251" src_port="43257" dst_port="5800"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.045840,2.666700,504,0 0 0 1 1 1 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="182.123.92.88"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.045840,2.666700,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="182.123.35.191" src_port="80"/>
            <filter dst_ip="182.123.35.191" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.080850,2.621630,999,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="214.182.37.14"/>
            <filter dst_ip="61.183.177.121"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.045840,2.666700,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="144.192.25.253" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
