<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.199740,1.549700,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="169.203.36.20" dst_ip="143.123.111.179" src_port="53005" dst_port="443"/>
            <filter src_ip="169.203.36.20" dst_ip="143.123.111.179" src_port="53004" dst_port="443"/>
            <filter src_ip="169.203.36.20" dst_ip="143.123.111.179" src_port="53002" dst_port="443"/>
            <filter src_ip="169.203.36.20" dst_ip="13.166.160.185" src_port="52989" dst_port="80"/>
            <filter src_ip="169.203.36.20" dst_ip="13.166.173.108" src_port="52999" dst_port="443"/>
        </slice>
        <from usec="0" sec="1422853441"/>
        <to usec="0" sec="1422853443"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="219.114.86.60" src_port="5129" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1422853308"/>
        <to usec="0" sec="1422853311"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="22.55.66.43" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853282"/>
        <to usec="0" sec="1422853292"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="14.62.59.89" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853445"/>
        <to usec="0" sec="1422853449"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="29.157.108.134" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853431"/>
        <to usec="0" sec="1422853443"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="206.214.161.59" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853450"/>
        <to usec="0" sec="1422853462"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="104.190.119.38" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853434"/>
        <to usec="0" sec="1422853444"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.218.69.66" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853206"/>
        <to usec="0" sec="1422853219"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="126.180.131.116" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853219"/>
        <to usec="0" sec="1422853222"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="157.167.249.124" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853375"/>
        <to usec="0" sec="1422853387"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="215.48.93.124" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853336"/>
        <to usec="0" sec="1422853361"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="24.152.188.184" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853491"/>
        <to usec="0" sec="1422853501"/>
    </anomaly>
    <anomaly type="suspicious" value="1.932050,1.956980,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="21.23.108.151" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853317"/>
        <to usec="0" sec="1422853326"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="22.226.7.89" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853440"/>
        <to usec="0" sec="1422853459"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="142.49.140.105" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853447"/>
        <to usec="0" sec="1422853449"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="24.85.82.221" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853215"/>
        <to usec="0" sec="1422853223"/>
    </anomaly>
    <anomaly type="suspicious" value="1.932050,1.956980,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="64.139.133.243" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853440"/>
        <to usec="0" sec="1422853452"/>
    </anomaly>
    <anomaly type="suspicious" value="1.932050,1.956980,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="31.79.7.24" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853340"/>
        <to usec="0" sec="1422853351"/>
    </anomaly>
    <anomaly type="suspicious" value="1.932050,1.956980,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="104.13.107.20" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853241"/>
        <to usec="0" sec="1422853267"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="126.232.181.54" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853366"/>
        <to usec="0" sec="1422853377"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="15.64.220.89" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853515"/>
        <to usec="0" sec="1422853520"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="26.112.144.218" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853356"/>
        <to usec="0" sec="1422853370"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="97.241.178.62" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853399"/>
        <to usec="0" sec="1422853425"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="80.35.57.93" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853288"/>
        <to usec="0" sec="1422853297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.932050,1.956980,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="157.107.109.70" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853375"/>
        <to usec="0" sec="1422853386"/>
    </anomaly>
    <anomaly type="suspicious" value="1.932050,1.956980,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="88.162.114.125" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853438"/>
        <to usec="0" sec="1422853449"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="104.7.209.248" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853218"/>
        <to usec="0" sec="1422853225"/>
    </anomaly>
    <anomaly type="suspicious" value="1.932050,1.956980,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="24.21.189.96" dst_port="5000"/>
        </slice>
        <from usec="0" sec="1422853350"/>
        <to usec="0" sec="1422853360"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="142.49.140.105"/>
        </slice>
        <from usec="0" sec="1422853447"/>
        <to usec="0" sec="1422853449"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="30.132.254.186" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853422"/>
        <to usec="0" sec="1422853433"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="22.134.38.151" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853337"/>
        <to usec="0" sec="1422853353"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="126.234.73.88" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853344"/>
        <to usec="0" sec="1422853350"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="16.38.216.192" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853321"/>
        <to usec="0" sec="1422853324"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,504,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="178.104.6.86" dst_ip="222.189.188.68" src_port="63476" dst_port="443"/>
            <filter src_ip="178.104.6.86" dst_ip="222.189.188.68" src_port="62302" dst_port="443"/>
        </slice>
        <from usec="0" sec="1422853219"/>
        <to usec="0" sec="1422853221"/>
    </anomaly>
    <anomaly type="suspicious" value="1.932050,1.956980,504,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="169.112.101.90" dst_ip="222.189.187.59" src_port="50139" dst_port="443"/>
        </slice>
        <from usec="0" sec="1422853338"/>
        <to usec="0" sec="1422853675"/>
    </anomaly>
    <anomaly type="suspicious" value="1.932050,1.956980,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="221.39.44.177" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1422853282"/>
        <to usec="0" sec="1422853284"/>
    </anomaly>
    <anomaly type="suspicious" value="1.932050,1.956980,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="21.231.96.2" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853301"/>
        <to usec="0" sec="1422853312"/>
    </anomaly>
    <anomaly type="suspicious" value="1.932050,1.956980,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="157.111.60.46" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853213"/>
        <to usec="0" sec="1422853225"/>
    </anomaly>
    <anomaly type="suspicious" value="1.932050,1.956980,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.35.4.93" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853487"/>
        <to usec="0" sec="1422853499"/>
    </anomaly>
    <anomaly type="suspicious" value="1.241900,1.317120,053,1 0 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="88.154.27.45" src_port="44382"/>
            <filter src_ip="27.99.175.85" dst_ip="169.112.239.43" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.156750,1.281730,503,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="173.208.24.107" dst_ip="195.61.168.52"/>
            <filter src_ip="173.208.24.107" dst_port="80"/>
            <filter src_ip="173.208.24.107" dst_port="443"/>
            <filter dst_ip="195.61.168.52" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.235570,1.375150,504,1 1 0 1 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="183.229.226.167" dst_ip="205.162.48.213" src_port="443" dst_port="49890"/>
            <filter src_ip="183.229.226.167" dst_ip="205.162.48.213" src_port="443" dst_port="49885"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.258530,1.521310,010,1 1 0 1 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="14.51.197.119" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853471"/>
        <to usec="0" sec="1422853483"/>
    </anomaly>
    <anomaly type="suspicious" value="1.258530,1.521310,010,1 1 0 1 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="27.79.253.67" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853534"/>
        <to usec="0" sec="1422853548"/>
    </anomaly>
    <anomaly type="suspicious" value="1.190840,1.461390,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="131.163.90.182" dst_ip="212.208.3.97" dst_port="80"/>
        </slice>
        <from usec="0" sec="1422853226"/>
        <to usec="0" sec="1422853304"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166540,1.308550,504,0 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="178.104.149.36" dst_port="443"/>
            <filter src_ip="178.104.149.36" dst_port="80"/>
            <filter dst_ip="123.218.137.119" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.190840,1.461390,504,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="169.203.40.133" dst_ip="86.203.240.127"/>
            <filter src_ip="169.203.40.133" dst_port="443"/>
            <filter dst_ip="86.203.240.127" dst_port="443"/>
            <filter src_ip="169.203.40.133" dst_ip="35.235.7.8" dst_port="80"/>
        </slice>
        <from usec="0" sec="1422853218"/>
        <to usec="0" sec="1422853577"/>
    </anomaly>
    <anomaly type="suspicious" value="1.190840,1.461390,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="20.16.1.168" dst_ip="205.162.57.230" src_port="80"/>
        </slice>
        <from usec="0" sec="1422853200"/>
        <to usec="0" sec="1422853488"/>
    </anomaly>
    <anomaly type="suspicious" value="1.190840,1.461390,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="149.225.105.87" dst_ip="131.163.125.249" src_port="443"/>
        </slice>
        <from usec="0" sec="1422853204"/>
        <to usec="0" sec="1422853488"/>
    </anomaly>
    <anomaly type="suspicious" value="1.190840,1.461390,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="131.163.181.233" src_port="20558"/>
            <filter src_ip="131.163.181.233" dst_port="80"/>
        </slice>
        <from usec="0" sec="1422853205"/>
        <to usec="0" sec="1422853483"/>
    </anomaly>
    <anomaly type="suspicious" value="1.190840,1.461390,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="173.208.240.147" dst_ip="192.43.142.198" dst_port="53"/>
            <filter src_ip="173.208.240.147" dst_ip="140.184.117.138" dst_port="53"/>
        </slice>
        <from usec="0" sec="1422853208"/>
        <to usec="0" sec="1422853473"/>
    </anomaly>
    <anomaly type="suspicious" value="1.190840,1.461390,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="173.208.228.43" dst_ip="10.144.35.230" src_port="49609" dst_port="443"/>
        </slice>
        <from usec="0" sec="1422853216"/>
        <to usec="0" sec="1422853389"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166540,1.308550,504,0 0 0 1 1 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="86.200.171.89" dst_ip="205.162.56.109" src_port="443" dst_port="51197"/>
            <filter src_ip="86.200.171.89" dst_ip="205.162.56.246" src_port="443" dst_port="52997"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.190840,1.461390,010,0 0 0 1 1 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="23.127.27.136" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853365"/>
        <to usec="0" sec="1422853381"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166540,1.308550,502,0 0 0 1 1 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="204.52.226.69" dst_ip="2.19.232.140" src_port="22"/>
            <filter src_ip="204.52.226.69" dst_ip="88.38.214.35" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166540,1.308550,999,0 0 0 1 1 0 0 0 0 1 1 0,ntscUDP">
        <slice>
            <filter src_ip="204.52.226.143" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.190840,1.461390,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="60.20.131.71" dst_ip="169.112.254.20" src_port="3074" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1422853200"/>
        <to usec="0" sec="1422853578"/>
    </anomaly>
    <anomaly type="suspicious" value="1.190840,1.461390,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="207.218.13.228" dst_ip="169.112.150.3" src_port="29547" dst_port="13030"/>
        </slice>
        <from usec="0" sec="1422853200"/>
        <to usec="0" sec="1422853578"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166540,1.308550,999,0 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="173.208.126.225"/>
            <filter src_ip="35.15.199.251" src_port="3544"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.128520,1.490910,999,0 0 0 0 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="92.217.217.33" dst_ip="189.121.175.28" src_port="38351" dst_port="12927"/>
        </slice>
        <from usec="0" sec="1422853203"/>
        <to usec="0" sec="1422853574"/>
    </anomaly>
    <anomaly type="suspicious" value="1.190840,1.461390,504,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="173.208.204.222" dst_ip="119.93.193.186" dst_port="443"/>
        </slice>
        <from usec="0" sec="1422853535"/>
        <to usec="0" sec="1422853578"/>
    </anomaly>
    <anomaly type="suspicious" value="1.290840,1.461500,010,1 0 0 1 1 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="17.16.62.59" dst_port="23"/>
        </slice>
        <from usec="0" sec="1422853540"/>
        <to usec="0" sec="1422853561"/>
    </anomaly>
    <anomaly type="suspicious" value="1.098570,1.498330,011,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="95.60.197.233"/>
        </slice>
        <from usec="0" sec="1422853200"/>
        <to usec="0" sec="1422853246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.098570,1.498330,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="169.112.95.235"/>
        </slice>
        <from usec="0" sec="1422853200"/>
        <to usec="0" sec="1422853246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.098570,1.498330,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="55.48.226.9"/>
        </slice>
        <from usec="0" sec="1422853200"/>
        <to usec="0" sec="1422853246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137600,1.317000,999,0 0 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="148.117.253.134" src_port="53"/>
            <filter dst_ip="173.208.177.163" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.098570,1.498330,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="205.170.86.167" dst_port="53"/>
        </slice>
        <from usec="0" sec="1422853200"/>
        <to usec="0" sec="1422853246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.098570,1.498330,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="47.70.73.1" src_port="49452" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1422853200"/>
        <to usec="0" sec="1422853246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.471850,1.521980,999,1 1 0 0 0 0 1 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="154.91.212.198" src_port="50702" dst_port="1900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.098570,1.498330,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="163.139.20.15"/>
        </slice>
        <from usec="0" sec="1422853200"/>
        <to usec="0" sec="1422853246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.098570,1.498330,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="204.52.229.21"/>
        </slice>
        <from usec="0" sec="1422853560"/>
        <to usec="0" sec="1422853606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.098570,1.498330,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="189.121.121.231"/>
        </slice>
        <from usec="0" sec="1422853560"/>
        <to usec="0" sec="1422853606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.098570,1.498330,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="204.52.226.188" dst_port="26123"/>
            <filter dst_ip="204.52.226.188" dst_port="27045"/>
        </slice>
        <from usec="0" sec="1422853560"/>
        <to usec="0" sec="1422853606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.098570,1.498330,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="169.112.234.210"/>
        </slice>
        <from usec="0" sec="1422853560"/>
        <to usec="0" sec="1422853606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.098570,1.498330,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="61.248.81.13" dst_port="443"/>
        </slice>
        <from usec="0" sec="1422853740"/>
        <to usec="0" sec="1422853786"/>
    </anomaly>
    <anomaly type="suspicious" value="1.098570,1.498330,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="47.70.73.1" src_port="49452" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1422853740"/>
        <to usec="0" sec="1422853786"/>
    </anomaly>
    <anomaly type="suspicious" value="1.241900,1.317120,011,1 0 0 1 0 0 1 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="204.52.225.22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.351870,1.384120,502,0 0 0 0 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="88.38.214.35" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.098570,1.498330,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="47.70.73.1" src_port="49452" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1422853920"/>
        <to usec="0" sec="1422853966"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166540,1.308550,502,0 0 0 1 1 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="173.208.193.79" dst_ip="215.193.223.128" src_port="22"/>
            <filter src_ip="173.208.207.86" dst_ip="215.193.223.128" src_port="22"/>
            <filter src_ip="173.208.193.95" dst_ip="215.193.223.128" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.092500,1.315300,503,1 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="173.208.227.47" dst_ip="86.200.91.218" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.156750,1.281730,504,1 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="55.75.142.180" dst_port="443"/>
            <filter dst_ip="55.75.142.180" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.092500,1.315300,504,1 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="169.112.252.58" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.123770,1.365430,999,0 0 0 1 1 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="183.206.38.138" dst_ip="169.112.254.20" src_port="3074" dst_port="1900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025490,1.404900,999,0 0 0 0 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="6.128.34.40" src_port="53"/>
            <filter dst_ip="173.208.149.0" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.133200,1.459560,010,1 1 0 0 0 0 0 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="157.140.210.114" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.092500,1.315300,504,1 0 0 0 0 0 0 0 0 1 1 1,malphfl">
        <slice>
            <filter src_ip="205.162.45.29" dst_ip="112.156.184.177" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.092500,1.315300,504,1 0 0 0 0 0 0 0 0 1 1 1,malphfl">
        <slice>
            <filter src_ip="205.162.57.209" dst_ip="160.1.224.122" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043980,1.281610,502,0 0 0 1 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="204.52.224.187" dst_ip="28.20.209.75" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025490,1.404900,999,0 0 0 0 0 0 1 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="204.52.250.245" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.072190,1.349680,010,0 0 0 0 0 0 1 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="211.141.183.182" dst_port="3128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.072190,1.349680,999,0 0 0 0 0 0 1 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="205.162.44.163" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.268460,1.308670,504,1 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="204.52.235.229" dst_port="443"/>
            <filter dst_ip="10.145.95.253" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="169.112.239.43" dst_ip="40.3.62.83" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166540,1.308550,999,0 0 0 1 1 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="169.112.238.34" src_port="25"/>
            <filter src_ip="204.52.224.184" src_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.182280,1.349800,020,1 0 0 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="204.52.225.10" dst_port="80"/>
            <filter src_ip="204.52.234.160"/>
            <filter src_ip="204.52.234.160"/>
            <filter src_ip="204.52.234.160" dst_port="80"/>
            <filter src_ip="204.52.225.10"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166540,1.308550,503,0 0 0 1 1 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="190.242.34.209" dst_ip="173.208.229.159" src_port="80"/>
            <filter src_ip="190.242.34.209" dst_ip="173.208.230.121" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199740,1.549700,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="47.70.73.1" src_port="49452" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1422853346"/>
        <to usec="0" sec="1422853476"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043980,1.281610,503,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="173.208.152.61" src_port="80"/>
            <filter dst_ip="173.208.36.9" src_port="80"/>
            <filter dst_ip="173.208.16.220" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043980,1.281610,503,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166540,1.308550,999,0 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="169.244.176.175" dst_port="53"/>
            <filter dst_ip="169.244.176.195" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.072190,1.349680,010,0 0 0 0 0 0 1 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="209.236.97.25" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043980,1.281610,504,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="169.203.11.205" src_port="443"/>
            <filter dst_ip="169.203.11.205" src_port="80"/>
            <filter src_ip="86.200.194.98" dst_ip="131.163.91.211" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166540,1.308550,504,0 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="44.81.44.166" src_port="443"/>
            <filter src_ip="44.81.44.166" src_port="80"/>
            <filter dst_ip="204.52.228.220" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166540,1.308550,503,0 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="156.142.10.115" src_port="80"/>
            <filter dst_ip="189.121.39.38" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166540,1.308550,999,0 0 0 1 1 0 0 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="189.121.224.104" dst_port="2096"/>
            <filter dst_ip="189.121.38.4" dst_port="10732"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166540,1.308550,503,0 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="158.157.255.45" dst_ip="189.121.118.140"/>
            <filter src_ip="158.157.255.45" src_port="80"/>
            <filter dst_ip="189.121.44.150" src_port="80"/>
            <filter dst_ip="189.121.118.140" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.093690,1.373530,010,0 0 0 1 0 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="209.236.97.3" dst_port="49155"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.175630,1.406490,503,1 1 0 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="205.162.48.213" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,010,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="1.6.151.146" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043980,1.281610,020,0 0 0 1 0 0 0 0 0 1 1 1,DDoSIC">
        <slice>
            <filter dst_ip="204.52.226.249" dst_port="33435"/>
            <filter dst_ip="205.170.97.44"/>
            <filter dst_ip="205.170.97.44"/>
            <filter dst_ip="205.170.97.44" dst_port="33435"/>
            <filter dst_ip="205.170.97.105"/>
            <filter dst_ip="205.170.97.105"/>
            <filter dst_ip="205.170.97.105" dst_port="33435"/>
            <filter dst_ip="204.52.226.249"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.175630,1.406490,502,1 1 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="2.19.232.220" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.123770,1.365430,010,0 0 0 1 1 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="43.252.194.214"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.175630,1.406490,999,1 1 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="204.52.224.184" src_port="80"/>
            <filter dst_ip="204.52.224.184" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,999,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="204.52.225.76" dst_port="61963"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.156750,1.281730,504,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="173.208.234.11" dst_ip="86.221.22.124"/>
            <filter src_ip="173.208.234.11" dst_port="443"/>
            <filter dst_ip="86.221.22.124" dst_port="443"/>
            <filter dst_ip="86.221.22.124" dst_port="80"/>
            <filter dst_ip="86.221.20.103" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.092500,1.315300,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="131.163.214.113" dst_ip="140.173.197.212"/>
            <filter src_ip="131.163.214.113" dst_port="80"/>
            <filter src_ip="131.163.214.113" dst_port="443"/>
            <filter dst_ip="140.173.197.212" dst_port="80"/>
            <filter dst_ip="140.173.197.212" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="169.112.150.3" src_port="13030"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025490,1.404900,020,0 0 0 0 0 0 1 0 0 1 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="92.155.210.220"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043980,1.281610,503,0 0 0 1 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="205.162.44.106" dst_ip="51.204.0.6" src_port="50635" dst_port="80"/>
            <filter src_ip="205.162.44.106" dst_ip="45.135.174.235" src_port="50742" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166540,1.308550,504,0 0 0 1 1 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="62.14.222.128" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,999,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="169.112.96.146" dst_ip="88.20.251.208"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025490,1.404900,020,0 0 0 0 0 0 1 0 0 1 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="47.70.73.1"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.435290,1.439560,503,1 1 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="131.163.238.225" dst_ip="158.17.208.98"/>
            <filter src_ip="131.163.238.225" dst_port="80"/>
            <filter src_ip="131.163.90.137" dst_ip="158.17.208.98"/>
            <filter src_ip="131.163.90.137" dst_port="80"/>
            <filter dst_ip="158.17.208.98" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025490,1.404900,999,0 0 0 0 0 0 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="204.52.225.76" src_port="61963"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,999,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="2.40.47.98" dst_ip="189.121.13.113" src_port="27023" dst_port="65511"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="14.135.66.235" dst_ip="169.203.89.219" src_port="80" dst_port="61693"/>
            <filter src_ip="14.135.66.235" dst_ip="169.203.89.219" src_port="80" dst_port="61692"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.072190,1.349680,999,0 0 0 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="30.113.242.118" dst_ip="205.170.101.45"/>
            <filter src_ip="30.113.242.118" src_port="53"/>
            <filter dst_ip="205.170.101.45" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.092500,1.315300,503,1 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="173.208.231.125" dst_ip="38.96.169.55" src_port="54974" dst_port="80"/>
            <filter src_ip="173.208.231.125" dst_ip="38.96.169.55" src_port="54936" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043980,1.281610,504,0 0 0 1 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="173.208.156.226" dst_ip="119.95.99.143" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,503,0 0 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="169.112.239.40" src_port="80"/>
            <filter src_ip="173.208.0.135" dst_ip="222.187.60.166" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="169.112.254.20" src_port="1900"/>
            <filter src_ip="169.112.254.20" dst_ip="2.19.232.251" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.072190,1.349680,999,0 0 0 0 0 0 1 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="205.162.40.132" src_port="53"/>
            <filter dst_ip="205.162.40.132" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.351870,1.384120,503,0 0 0 0 0 0 1 0 0 1 1 1,ntscACKt">
        <slice>
            <filter src_ip="204.52.234.174" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,010,0 0 0 0 0 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="212.249.133.96" dst_port="1080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="131.163.214.113" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.092500,1.315300,504,1 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="83.38.92.149" dst_ip="189.121.226.150" src_port="443" dst_port="51530"/>
            <filter src_ip="83.38.92.149" dst_ip="189.121.226.150" src_port="443" dst_port="51527"/>
            <filter src_ip="83.38.92.149" dst_ip="131.163.175.66" src_port="443" dst_port="54201"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.092500,1.315300,503,1 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="205.162.57.236" src_port="443"/>
            <filter dst_ip="205.162.57.236" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,502,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="205.170.122.176" dst_ip="30.214.6.100" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,999,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="204.52.238.172" dst_ip="21.110.201.73" src_port="54845" dst_port="8340"/>
            <filter src_ip="204.52.238.172" dst_ip="21.110.201.73" src_port="47179" dst_port="8337"/>
            <filter src_ip="204.52.238.172" dst_ip="21.110.201.73" src_port="46190" dst_port="8335"/>
            <filter src_ip="204.52.238.172" dst_ip="21.110.201.73" src_port="3001" dst_port="8333"/>
            <filter src_ip="204.52.238.173" dst_ip="21.110.201.73"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043980,1.281610,504,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter src_ip="157.44.195.166" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,999,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="173.208.153.225" dst_port="6144"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="203.165.100.1" dst_ip="173.208.164.43" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166540,1.308550,503,0 0 0 1 1 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="119.73.191.148" src_port="80"/>
            <filter src_ip="92.184.218.67" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043980,1.281610,502,0 0 0 1 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="215.141.6.255" dst_ip="169.112.100.212" dst_port="22"/>
            <filter src_ip="2.19.232.251" dst_ip="169.112.100.212" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,999,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="169.99.27.176" dst_port="21805"/>
            <filter dst_ip="169.99.27.176" dst_port="4605"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.072190,1.349680,054,0 0 0 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="112.143.178.217" dst_ip="189.121.227.35"/>
            <filter src_ip="112.143.178.217" dst_ip="131.163.239.189" src_port="443"/>
            <filter src_ip="112.143.178.182" dst_ip="189.121.227.35" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.137600,1.317000,999,0 0 0 1 0 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="189.121.227.230" src_port="80"/>
            <filter dst_ip="189.121.227.230" dst_port="8506"/>
            <filter dst_ip="189.121.227.230" dst_port="11765"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="20.16.1.170" src_port="80"/>
            <filter dst_ip="205.162.45.29" src_port="80"/>
            <filter dst_ip="205.162.45.29" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043980,1.281610,504,0 0 0 1 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="131.163.89.71" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.166540,1.308550,999,0 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="205.162.56.178" dst_ip="205.29.66.236" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.092500,1.315300,503,1 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="205.170.86.177" dst_port="443"/>
            <filter src_ip="19.13.83.170" dst_ip="205.170.86.177" dst_port="80"/>
            <filter src_ip="62.143.201.167" dst_ip="205.170.86.177" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.043980,1.281610,020,0 0 0 1 0 0 0 0 0 1 1 1,ntscTCPICdurp">
        <slice>
            <filter dst_ip="92.155.210.222"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.268460,1.308670,504,1 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="169.203.95.126" dst_port="443"/>
            <filter src_ip="169.203.95.126" dst_port="80"/>
            <filter dst_ip="48.192.142.77" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,999,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="204.52.228.128" dst_ip="43.14.119.218" src_port="64023" dst_port="51413"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,999,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="9.149.164.174" dst_ip="169.112.150.3" src_port="41266" dst_port="55425"/>
            <filter src_ip="9.149.164.174" dst_ip="169.112.150.3" src_port="41266" dst_port="55383"/>
            <filter src_ip="9.149.164.174" dst_ip="169.112.150.3" src_port="41266" dst_port="54491"/>
            <filter src_ip="9.149.164.174" dst_ip="169.112.150.3" src_port="41266" dst_port="13030"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter src_ip="205.171.111.63" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,020,0 0 0 0 0 0 0 0 0 1 1 1,icmp_error">
        <slice>
            <filter src_ip="173.208.160.217"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,020,0 0 0 0 0 0 0 0 0 1 1 1,icmp_error">
        <slice>
            <filter src_ip="204.52.226.249" src_port="33435"/>
            <filter src_ip="204.52.226.249"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,999,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="222.151.172.32" dst_ip="173.208.126.225" src_port="8888"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="88.27.183.234" dst_ip="131.163.238.225" src_port="80" dst_port="52966"/>
            <filter src_ip="88.27.183.234" dst_ip="131.163.238.225" src_port="80" dst_port="52810"/>
            <filter src_ip="88.27.183.234" dst_ip="131.163.238.225" src_port="80" dst_port="52809"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="92.35.46.61" dst_ip="205.162.58.218" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,502,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="194.240.160.37" dst_ip="189.121.121.227" src_port="34908" dst_port="22"/>
            <filter src_ip="194.240.160.37" dst_ip="189.121.121.199" src_port="56918" dst_port="22"/>
            <filter src_ip="2.19.232.215" dst_ip="189.121.121.227" src_port="45533" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972300,1.315170,999,0 0 0 0 0 0 0 0 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="204.52.248.250" dst_port="1357"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.512270,1.344160,504,1 0 0 1 1 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="48.192.154.8" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.832400,1.497010,020,1 1 0 1 1 0 1 0 0 1 1 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="209.236.97.22"/>
            <filter dst_ip="209.236.97.25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.101200,2.615430,999,1 1 1 1 1 1 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="10.0.0.1" dst_ip="10.1.0.1"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.120860,1.847540,503,1 1 1 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="204.52.230.65" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.917170,1.845650,999,1 1 1 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="131.163.98.218" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.288160,1.920070,502,1 1 1 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="205.170.105.65"/>
            <filter src_ip="61.196.26.29" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.954500,1.821880,502,1 1 1 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="2.19.232.251" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.756920,1.473520,011,1 1 0 1 0 0 1 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="44.208.157.98" dst_ip="204.52.235.220" dst_port="80"/>
            <filter src_ip="199.141.157.101" dst_ip="204.52.235.220" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.208640,2.633360,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="12.51.229.58" src_port="37972" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.780210,1.411680,503,1 0 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.709080,1.411570,503,0 0 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="50.252.226.1"/>
            <filter dst_ip="205.85.66.107" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.624360,2.272380,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="169.112.95.18"/>
            <filter src_ip="92.184.218.117" dst_ip="204.52.248.231" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.671220,2.272450,504,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter dst_ip="205.162.56.57" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.787370,2.312960,010,0 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="146.95.192.48" src_port="80"/>
            <filter src_ip="110.236.193.72" src_port="44405"/>
            <filter src_ip="205.171.111.103" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.440740,1.384230,503,1 0 0 0 0 0 1 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="204.52.235.220" dst_ip="199.141.157.101" src_port="80"/>
            <filter src_ip="204.52.235.220" dst_ip="44.208.157.98" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.134880,1.895400,010,1 1 1 0 0 0 1 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="212.249.162.143" src_port="12200"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.497670,1.377820,999,0 0 0 1 1 0 1 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="173.208.177.163" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.630400,2.010010,503,1 0 0 1 1 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_port="53"/>
            <filter dst_ip="205.170.86.167" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.406100,4.657640,502,0 0 0 1 1 0 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="61.196.26.29" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.508230,4.694280,503,1 1 0 1 1 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="189.121.68.89" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.756920,1.473520,999,1 1 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="53"/>
            <filter src_ip="205.170.101.45" dst_port="53"/>
            <filter src_ip="205.162.40.132" dst_port="53"/>
            <filter src_ip="204.52.231.113" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.709080,1.411570,503,0 0 0 1 1 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="189.121.68.253" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.582800,2.009930,503,0 0 0 1 1 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="49.46.240.229" dst_ip="169.109.44.172"/>
            <filter dst_ip="169.109.44.172" src_port="80"/>
            <filter dst_ip="169.109.44.172" src_port="443"/>
            <filter src_ip="49.46.240.229" dst_ip="169.109.44.175" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.443390,1.968810,503,1 0 0 1 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="204.52.234.174" dst_port="80"/>
            <filter dst_ip="204.52.234.175" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.191230,2.005250,504,0 0 0 0 0 0 1 1 0 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="131.163.239.189" dst_ip="112.143.178.217" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.191230,2.005250,504,0 0 0 0 0 0 1 1 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="208.121.82.143" dst_ip="189.58.32.106" dst_port="443"/>
            <filter src_ip="19.40.236.56" dst_ip="189.58.32.106" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.226370,2.071780,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="204.52.231.117" dst_port="53"/>
        </slice>
        <from usec="0" sec="1422853560"/>
        <to usec="0" sec="1422853606"/>
    </anomaly>
    <anomaly type="anomalous" value="2.582800,2.009930,503,0 0 0 1 1 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="205.170.105.65" src_port="80"/>
            <filter src_ip="61.127.2.95" dst_ip="205.170.105.65" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.448040,1.986380,999,0 0 0 1 1 0 1 1 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="204.52.228.128" dst_port="51413"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.208640,2.633360,503,1 1 1 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="189.121.68.89" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.404310,1.352260,999,0 0 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.671220,2.272450,503,1 0 0 1 1 1 0 0 0 1 1 1,ntscACKt">
        <slice>
            <filter src_ip="92.184.218.106" src_port="80"/>
            <filter src_ip="21.56.64.139" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.245890,1.944680,502,0 0 0 1 0 0 1 1 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="2.19.232.251" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.756920,1.473520,503,1 1 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="80"/>
            <filter dst_ip="140.173.197.212" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.891450,1.886410,010,1 1 1 0 0 0 0 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.50.219.141" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.427860,1.344040,999,0 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="204.52.238.180"/>
            <filter src_ip="204.52.238.163"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.392060,1.968730,999,0 0 0 1 0 0 1 1 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="189.121.65.63" src_port="53"/>
            <filter dst_ip="205.162.40.132" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.168470,1.872260,010,1 1 1 1 0 0 1 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="93.166.127.161" dst_port="8080"/>
            <filter src_ip="92.155.210.220" src_port="60000" dst_port="50070"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.427860,1.344040,503,0 0 0 1 1 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="92.184.218.89" src_port="80"/>
            <filter src_ip="92.184.218.106" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.319530,1.897230,010,1 1 1 1 0 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="27.24.177.4" src_port="6000" dst_port="38080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.404310,1.352260,503,0 0 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="158.157.255.45" src_port="80"/>
            <filter dst_ip="189.121.39.207" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.427860,1.344040,503,0 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter dst_ip="131.163.239.88" dst_port="6881"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.512270,1.344160,503,1 0 0 1 1 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="204.52.230.65" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.780210,1.411680,503,1 0 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="80"/>
            <filter dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.168470,1.872260,010,1 1 1 1 0 0 1 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="92.155.210.222" src_port="60000" dst_port="50010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.343290,2.668460,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="12.130.86.205"/>
            <filter src_ip="55.109.106.49"/>
            <filter src_ip="2.19.232.240" src_port="9090" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.624360,2.272380,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="62.143.201.4" dst_ip="205.85.66.107"/>
            <filter src_ip="62.143.201.4" src_port="80"/>
            <filter dst_ip="205.85.66.107" src_port="80"/>
            <filter src_ip="62.143.201.12" dst_ip="205.162.57.130" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.134880,1.895400,999,1 1 1 0 0 0 1 0 0 1 1 0,ntscUDP">
        <slice>
            <filter src_ip="219.226.239.19" src_port="5096" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.863600,3.027870,010,1 1 1 1 1 1 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="158.28.210.173" dst_port="1723"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.086500,1.870980,999,1 1 1 0 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="204.52.230.177" dst_ip="203.41.133.10"/>
            <filter src_ip="204.52.230.177" dst_ip="201.244.138.11"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.578350,1.377940,504,1 0 0 1 1 0 1 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="205.85.66.107" dst_ip="140.173.235.250"/>
            <filter src_ip="205.85.66.107" dst_port="80"/>
            <filter src_ip="205.85.66.107" dst_port="443"/>
            <filter dst_ip="140.173.235.250" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.624360,2.272380,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="131.163.254.165" dst_port="19590"/>
            <filter src_ip="119.114.251.46" dst_ip="205.162.158.125" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.790260,2.093440,010,1 1 0 1 1 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="204.52.225.22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.300480,1.944760,999,1 0 0 1 0 0 1 1 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="204.52.250.245" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.213480,1.966960,502,0 0 0 0 0 0 1 1 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="2.19.232.143" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.427860,1.344040,503,0 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter src_ip="92.184.218.83" src_port="443"/>
            <filter dst_ip="205.162.158.165" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.343290,2.668460,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="35.91.205.184" src_port="62761" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.343030,4.647530,503,0 0 0 1 1 0 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="205.85.66.107" src_port="80"/>
            <filter dst_ip="205.85.66.107" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.671220,2.272450,504,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="131.163.175.66" dst_ip="83.38.69.45"/>
            <filter src_ip="131.163.175.66" dst_port="443"/>
            <filter dst_ip="83.38.69.45" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.630400,2.010010,503,1 0 0 1 1 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.624360,2.272380,503,0 0 0 1 1 1 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="199.4.134.24" src_port="80"/>
            <filter src_ip="199.4.134.24" src_port="443"/>
            <filter src_ip="49.46.243.42" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
