<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="0.809458,1.180870,504,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="77.86.237.59" dst_port="443"/>
        </slice>
        <from usec="0" sec="1425359070"/>
        <to usec="0" sec="1425359633"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="145.164.181.194" dst_ip="110.227.133.144" dst_port="443"/>
            <filter src_ip="145.164.181.194" dst_ip="110.227.130.13" dst_port="443"/>
            <filter src_ip="145.164.181.194" dst_ip="110.227.128.21" dst_port="443"/>
        </slice>
        <from usec="0" sec="1425358846"/>
        <to usec="0" sec="1425359575"/>
    </anomaly>
    <anomaly type="suspicious" value="0.833289,1.172900,504,1 1 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="148.165.79.149" dst_ip="8.225.1.34"/>
            <filter src_ip="148.165.79.149" dst_port="443"/>
            <filter dst_ip="8.225.1.34" dst_port="443"/>
        </slice>
        <from usec="0" sec="1425359043"/>
        <to usec="0" sec="1425359268"/>
    </anomaly>
    <anomaly type="suspicious" value="1.264820,1.348130,999,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="217.30.33.168" dst_ip="203.178.189.132" src_port="59299" dst_port="25"/>
            <filter src_ip="31.64.2.218" dst_ip="203.178.189.132" src_port="57004" dst_port="25"/>
            <filter src_ip="203.179.14.63" dst_ip="203.178.189.132" src_port="46416" dst_port="25"/>
        </slice>
        <from usec="0" sec="1425359228"/>
        <to usec="0" sec="1425359249"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="99.69.139.10" dst_ip="203.178.189.118" src_port="44289" dst_port="443"/>
        </slice>
        <from usec="0" sec="1425359327"/>
        <to usec="0" sec="1425359330"/>
    </anomaly>
    <anomaly type="suspicious" value="1.264820,1.348130,502,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="49.93.196.169" dst_port="22"/>
        </slice>
        <from usec="0" sec="1425358970"/>
        <to usec="0" sec="1425359632"/>
    </anomaly>
    <anomaly type="suspicious" value="0.967476,1.168560,503,1 1 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="145.164.225.38" dst_port="80"/>
            <filter src_ip="145.164.225.38" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.818718,1.199360,010,0 1 0 1 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="47.25.61.67" dst_port="22"/>
        </slice>
        <from usec="0" sec="1425358845"/>
        <to usec="0" sec="1425359622"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="145.164.91.173" dst_port="80"/>
        </slice>
        <from usec="0" sec="1425359043"/>
        <to usec="0" sec="1425359584"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,901,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="145.164.191.11" dst_ip="104.6.230.179" dst_port="443"/>
        </slice>
        <from usec="0" sec="1425358804"/>
        <to usec="0" sec="1425359616"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,502,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="34.107.140.143" dst_ip="202.88.183.26" src_port="60232" dst_port="22"/>
        </slice>
        <from usec="0" sec="1425359552"/>
        <to usec="0" sec="1425359617"/>
    </anomaly>
    <anomaly type="suspicious" value="1.264820,1.348130,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="214.131.10.219" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425359318"/>
        <to usec="0" sec="1425359330"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="219.203.117.201"/>
        </slice>
        <from usec="0" sec="1425359397"/>
        <to usec="0" sec="1425359399"/>
    </anomaly>
    <anomaly type="suspicious" value="1.264820,1.348130,999,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="21.213.92.219" dst_ip="129.76.221.102" src_port="59803" dst_port="8118"/>
            <filter src_ip="4.98.101.245" dst_ip="129.76.221.102" src_port="52235" dst_port="25"/>
            <filter src_ip="4.98.101.241" dst_ip="129.76.221.102" src_port="50890" dst_port="25"/>
        </slice>
        <from usec="0" sec="1425359248"/>
        <to usec="0" sec="1425359256"/>
    </anomaly>
    <anomaly type="suspicious" value="0.833289,1.172900,503,1 1 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="15.37.141.24" dst_ip="203.178.189.251" src_port="80"/>
        </slice>
        <from usec="0" sec="1425358800"/>
        <to usec="0" sec="1425359624"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="221.45.204.22" dst_ip="148.11.173.81" src_port="59300" dst_port="80"/>
        </slice>
        <from usec="0" sec="1425359206"/>
        <to usec="0" sec="1425359210"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="187.102.107.158" dst_ip="203.179.175.40" dst_port="80"/>
        </slice>
        <from usec="0" sec="1425359089"/>
        <to usec="0" sec="1425359092"/>
    </anomaly>
    <anomaly type="suspicious" value="1.280200,1.341160,999,1 1 1 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="217.62.238.195"/>
        </slice>
        <from usec="0" sec="1425358860"/>
        <to usec="0" sec="1425359636"/>
    </anomaly>
    <anomaly type="suspicious" value="1.264820,1.348130,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="217.62.238.217" src_port="2000" dst_port="80"/>
        </slice>
        <from usec="0" sec="1425358901"/>
        <to usec="0" sec="1425359662"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="219.203.117.201" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425359397"/>
        <to usec="0" sec="1425359400"/>
    </anomaly>
    <anomaly type="suspicious" value="1.264820,1.348130,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="60.218.224.145" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425359241"/>
        <to usec="0" sec="1425359256"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="30.33.8.197" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425359543"/>
        <to usec="0" sec="1425359584"/>
    </anomaly>
    <anomaly type="suspicious" value="1.264820,1.348130,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="101.173.253.207" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425358909"/>
        <to usec="0" sec="1425358935"/>
    </anomaly>
    <anomaly type="suspicious" value="1.264820,1.348130,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="60.219.85.231" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425359070"/>
        <to usec="0" sec="1425359082"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="163.71.178.145" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425359087"/>
        <to usec="0" sec="1425359101"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="126.77.208.158" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425359295"/>
        <to usec="0" sec="1425359308"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="35.246.191.163" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425359383"/>
        <to usec="0" sec="1425359390"/>
    </anomaly>
    <anomaly type="suspicious" value="1.264820,1.348130,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="35.40.83.39" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425359469"/>
        <to usec="0" sec="1425359483"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="164.29.64.230" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425358845"/>
        <to usec="0" sec="1425358869"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="126.77.208.136" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425359194"/>
        <to usec="0" sec="1425359206"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="37.190.88.175" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425359086"/>
        <to usec="0" sec="1425359229"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="162.132.113.220" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425359035"/>
        <to usec="0" sec="1425359067"/>
    </anomaly>
    <anomaly type="suspicious" value="1.264820,1.348130,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="192.119.174.67" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425359480"/>
        <to usec="0" sec="1425359485"/>
    </anomaly>
    <anomaly type="suspicious" value="1.264820,1.348130,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="36.17.91.112" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425359223"/>
        <to usec="0" sec="1425359232"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,502,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="197.174.160.225" dst_ip="202.88.178.196" dst_port="53"/>
            <filter src_ip="197.174.160.225" dst_ip="202.88.178.199" dst_port="22"/>
        </slice>
        <from usec="0" sec="1425358917"/>
        <to usec="0" sec="1425359212"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="143.197.242.39" dst_ip="77.86.239.212" src_port="64894" dst_port="443"/>
        </slice>
        <from usec="0" sec="1425358917"/>
        <to usec="0" sec="1425358920"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="35.246.191.163"/>
        </slice>
        <from usec="0" sec="1425359383"/>
        <to usec="0" sec="1425359390"/>
    </anomaly>
    <anomaly type="suspicious" value="0.809458,1.180870,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="101.122.223.66" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425359571"/>
        <to usec="0" sec="1425359584"/>
    </anomaly>
    <anomaly type="suspicious" value="0.833289,1.172900,503,1 1 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="148.165.213.223" dst_port="80"/>
        </slice>
        <from usec="0" sec="1425358971"/>
        <to usec="0" sec="1425359307"/>
    </anomaly>
    <anomaly type="suspicious" value="1.063720,1.325130,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="130.52.237.254" dst_ip="130.52.237.254"/>
        </slice>
        <from usec="0" sec="1425358860"/>
        <to usec="0" sec="1425359637"/>
    </anomaly>
    <anomaly type="suspicious" value="1.264820,1.348130,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="21.213.93.143" dst_port="22"/>
        </slice>
        <from usec="0" sec="1425359206"/>
        <to usec="0" sec="1425359213"/>
    </anomaly>
    <anomaly type="suspicious" value="1.264820,1.348130,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="164.239.158.110" dst_port="23"/>
        </slice>
        <from usec="0" sec="1425359061"/>
        <to usec="0" sec="1425359086"/>
    </anomaly>
    <anomaly type="suspicious" value="1.264820,1.348130,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="192.119.174.67"/>
        </slice>
        <from usec="0" sec="1425359480"/>
        <to usec="0" sec="1425359484"/>
    </anomaly>
    <anomaly type="suspicious" value="1.076850,1.272140,504,1 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="187.102.253.4" dst_ip="176.91.2.207" dst_port="443"/>
        </slice>
        <from usec="0" sec="1425358800"/>
        <to usec="0" sec="1425359623"/>
    </anomaly>
    <anomaly type="suspicious" value="1.280200,1.341160,011,1 1 1 1 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="61.203.215.110" src_port="3389"/>
        </slice>
        <from usec="0" sec="1425359192"/>
        <to usec="0" sec="1425359558"/>
    </anomaly>
    <anomaly type="suspicious" value="0.833289,1.172900,504,1 1 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="145.164.22.233" dst_port="443"/>
            <filter dst_ip="77.86.229.80" dst_port="443"/>
        </slice>
        <from usec="0" sec="1425358800"/>
        <to usec="0" sec="1425359623"/>
    </anomaly>
    <anomaly type="suspicious" value="1.076850,1.272140,504,1 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="77.86.239.212" dst_port="443"/>
        </slice>
        <from usec="0" sec="1425359024"/>
        <to usec="0" sec="1425359464"/>
    </anomaly>
    <anomaly type="suspicious" value="1.455820,1.466140,999,1 1 0 1 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.88.164.52" dst_port="53"/>
        </slice>
        <from usec="0" sec="1425358810"/>
        <to usec="0" sec="1425359656"/>
    </anomaly>
    <anomaly type="suspicious" value="1.076850,1.272140,504,1 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="61.9.185.184" dst_ip="187.102.253.4" src_port="443" dst_port="51295"/>
        </slice>
        <from usec="0" sec="1425358800"/>
        <to usec="0" sec="1425359628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065610,1.296580,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="30.145.62.54" dst_ip="187.102.76.72" src_port="80"/>
        </slice>
        <from usec="0" sec="1425359026"/>
        <to usec="0" sec="1425359347"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065610,1.296580,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="59.185.25.70" src_port="443"/>
        </slice>
        <from usec="0" sec="1425358800"/>
        <to usec="0" sec="1425359444"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065610,1.296580,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="148.182.102.252" dst_ip="39.199.103.138"/>
            <filter src_ip="148.182.102.252" src_port="38324"/>
            <filter dst_ip="39.199.103.138" src_port="38324"/>
        </slice>
        <from usec="0" sec="1425358823"/>
        <to usec="0" sec="1425359448"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065610,1.296580,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="41.38.56.147" dst_port="7547"/>
        </slice>
        <from usec="0" sec="1425358800"/>
        <to usec="0" sec="1425359538"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065610,1.296580,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="204.42.243.171" dst_ip="148.185.61.7" src_port="17138" dst_port="20173"/>
        </slice>
        <from usec="0" sec="1425358800"/>
        <to usec="0" sec="1425359477"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065610,1.296580,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="4.35.121.1" dst_port="8080"/>
            <filter src_ip="4.35.121.1" dst_port="5916"/>
            <filter src_ip="4.35.121.1" dst_port="80"/>
            <filter src_ip="4.35.121.1" src_port="32811" dst_port="3143"/>
        </slice>
        <from usec="0" sec="1425358802"/>
        <to usec="0" sec="1425359538"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065610,1.296580,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="46.19.192.10" dst_ip="129.76.2.181" src_port="80"/>
        </slice>
        <from usec="0" sec="1425359323"/>
        <to usec="0" sec="1425359375"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065610,1.296580,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="176.68.105.83" src_port="80"/>
            <filter src_ip="176.68.105.83" src_port="443"/>
        </slice>
        <from usec="0" sec="1425358800"/>
        <to usec="0" sec="1425359628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065610,1.296580,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="12.213.201.165" dst_port="17185"/>
        </slice>
        <from usec="0" sec="1425358800"/>
        <to usec="0" sec="1425359628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065610,1.296580,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="143.197.247.78" dst_port="53"/>
        </slice>
        <from usec="0" sec="1425358807"/>
        <to usec="0" sec="1425359624"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065610,1.296580,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="210.171.45.23" dst_ip="187.102.76.62" src_port="27019" dst_port="64479"/>
        </slice>
        <from usec="0" sec="1425358811"/>
        <to usec="0" sec="1425359625"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065610,1.296580,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="168.168.160.79" dst_ip="187.102.54.222" src_port="443"/>
            <filter src_ip="168.168.160.79" dst_ip="187.102.77.25" src_port="443"/>
            <filter src_ip="168.168.160.79" dst_ip="148.165.216.226" src_port="443"/>
        </slice>
        <from usec="0" sec="1425359294"/>
        <to usec="0" sec="1425359569"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065610,1.296580,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="148.182.20.98" dst_ip="8.225.2.121" dst_port="443"/>
            <filter src_ip="148.182.20.98" dst_ip="8.225.2.121" dst_port="80"/>
        </slice>
        <from usec="0" sec="1425359374"/>
        <to usec="0" sec="1425359587"/>
    </anomaly>
    <anomaly type="suspicious" value="1.065610,1.296580,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="192.74.222.105" dst_ip="148.165.213.223" src_port="47904" dst_port="80"/>
        </slice>
        <from usec="0" sec="1425359593"/>
        <to usec="0" sec="1425359616"/>
    </anomaly>
    <anomaly type="suspicious" value="1.269640,1.451490,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.88.178.252" dst_port="53"/>
        </slice>
        <from usec="0" sec="1425358890"/>
        <to usec="0" sec="1425358936"/>
    </anomaly>
    <anomaly type="suspicious" value="1.284970,1.445020,053,0 0 0 1 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.88.178.252" dst_port="80"/>
        </slice>
        <from usec="0" sec="1425358801"/>
        <to usec="0" sec="1425359234"/>
    </anomaly>
    <anomaly type="suspicious" value="1.269640,1.451490,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.88.178.253" dst_port="53"/>
        </slice>
        <from usec="0" sec="1425358890"/>
        <to usec="0" sec="1425358936"/>
    </anomaly>
    <anomaly type="suspicious" value="1.269640,1.451490,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="160.126.45.107"/>
        </slice>
        <from usec="0" sec="1425358935"/>
        <to usec="0" sec="1425358981"/>
    </anomaly>
    <anomaly type="suspicious" value="1.269640,1.451490,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.95.30.223" dst_port="443"/>
        </slice>
        <from usec="0" sec="1425358935"/>
        <to usec="0" sec="1425358981"/>
    </anomaly>
    <anomaly type="suspicious" value="1.269640,1.451490,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="99.116.97.83"/>
        </slice>
        <from usec="0" sec="1425359160"/>
        <to usec="0" sec="1425359206"/>
    </anomaly>
    <anomaly type="suspicious" value="1.269640,1.451490,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.88.178.253" dst_port="53"/>
        </slice>
        <from usec="0" sec="1425359385"/>
        <to usec="0" sec="1425359431"/>
    </anomaly>
    <anomaly type="suspicious" value="1.269640,1.451490,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="99.116.97.83" src_port="60000" dst_port="5632"/>
        </slice>
        <from usec="0" sec="1425359430"/>
        <to usec="0" sec="1425359476"/>
    </anomaly>
    <anomaly type="suspicious" value="1.269640,1.451490,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="187.102.77.133" src_port="19835"/>
        </slice>
        <from usec="0" sec="1425359430"/>
        <to usec="0" sec="1425359476"/>
    </anomaly>
    <anomaly type="suspicious" value="1.269640,1.451490,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.88.178.252" dst_port="53"/>
        </slice>
        <from usec="0" sec="1425359610"/>
        <to usec="0" sec="1425359656"/>
    </anomaly>
    <anomaly type="suspicious" value="1.269640,1.451490,053,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.88.178.252" dst_port="80"/>
        </slice>
        <from usec="0" sec="1425359610"/>
        <to usec="0" sec="1425359656"/>
    </anomaly>
    <anomaly type="suspicious" value="1.269640,1.451490,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="129.76.205.116" src_port="53"/>
            <filter dst_ip="129.76.205.116"/>
        </slice>
        <from usec="0" sec="1425359610"/>
        <to usec="0" sec="1425359701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070150,1.166420,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="129.76.191.90" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070150,1.166420,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="21.145.241.245" src_port="80"/>
            <filter dst_ip="187.102.129.13" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.081330,1.139190,503,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="69.148.5.241" src_port="80"/>
            <filter dst_ip="187.102.159.0" src_port="80"/>
            <filter dst_ip="187.102.159.0" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.967476,1.168560,503,1 1 0 0 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="202.88.178.253" src_port="80"/>
            <filter src_ip="202.88.178.253" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070150,1.166420,504,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="197.12.52.56" dst_ip="203.63.142.201"/>
            <filter src_ip="197.12.52.56" src_port="80"/>
            <filter src_ip="197.12.52.56" src_port="443"/>
            <filter dst_ip="203.63.142.201" src_port="80"/>
            <filter dst_ip="203.63.142.201" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070150,1.166420,504,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="203.189.147.93" dst_ip="110.255.25.130"/>
            <filter src_ip="203.189.147.93" dst_port="443"/>
            <filter src_ip="203.189.147.93" dst_port="993"/>
            <filter dst_ip="110.255.25.130" dst_port="443"/>
            <filter src_ip="145.164.189.185" dst_ip="110.255.25.130" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.967476,1.168560,503,1 1 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="187.102.76.173" dst_ip="21.145.241.245" src_port="62052" dst_port="80"/>
            <filter src_ip="187.102.76.173" dst_ip="21.145.241.245" src_port="62050" dst_port="80"/>
            <filter src_ip="187.102.76.173" dst_ip="21.145.241.245" src_port="62029" dst_port="80"/>
            <filter src_ip="187.102.129.13" dst_ip="21.145.241.245" src_port="55527" dst_port="80"/>
            <filter src_ip="187.102.129.13" dst_ip="21.145.241.245" src_port="55526" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070150,1.166420,503,0 0 0 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="203.189.142.46" dst_port="443"/>
            <filter src_ip="203.189.142.46" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070150,1.166420,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="202.88.183.145" dst_ip="56.214.253.78" src_port="55005"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070150,1.166420,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="145.164.22.53" src_port="80"/>
            <filter dst_ip="145.164.22.53" src_port="443"/>
            <filter dst_ip="145.164.22.53" dst_port="58382"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.099290,1.130930,503,1 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="129.76.201.176" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070150,1.166420,504,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="193.236.241.204" dst_ip="187.102.138.161"/>
            <filter src_ip="193.236.241.204" src_port="443"/>
            <filter dst_ip="187.102.138.161" src_port="443"/>
            <filter dst_ip="187.102.138.161" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070150,1.166420,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="197.159.34.220" dst_ip="187.102.147.165" src_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.070150,1.166420,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="15.147.9.234" src_port="53"/>
            <filter src_ip="148.165.97.56" dst_ip="15.147.9.234" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.198000,1.311870,504,0 0 0 1 0 0 0 0 0 0 0 1,mptmp">
        <slice>
            <filter src_ip="197.12.52.56" dst_ip="203.63.142.201"/>
            <filter src_ip="197.12.52.56" src_port="80"/>
            <filter src_ip="197.12.52.56" src_port="443"/>
            <filter dst_ip="203.63.142.201" src_port="80"/>
            <filter dst_ip="203.63.142.201" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.876800,2.128530,503,1 1 1 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="129.76.201.86" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.940920,1.500610,999,1 1 1 0 0 0 0 0 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="203.178.189.251" dst_port="8612"/>
            <filter src_ip="203.178.189.251" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.385540,1.330330,504,1 1 1 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="145.164.236.31" dst_port="80"/>
            <filter src_ip="145.164.236.31" dst_port="443"/>
            <filter src_ip="187.102.79.106" dst_port="80"/>
            <filter src_ip="187.102.79.106" dst_port="443"/>
            <filter dst_ip="193.232.195.74" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.607690,1.546680,504,1 0 0 1 1 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="8.225.2.121" dst_port="443"/>
        </slice>
        <from usec="0" sec="1425358801"/>
        <to usec="0" sec="1425359656"/>
    </anomaly>
    <anomaly type="anomalous" value="1.599390,1.358320,999,1 1 1 0 0 0 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="202.88.184.244" dst_ip="205.78.215.208"/>
            <filter src_ip="202.88.184.244" dst_ip="206.101.84.234"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.171580,1.612450,010,1 1 1 1 1 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="61.203.215.110" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.171580,1.612450,503,1 1 1 1 1 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="193.108.9.71" dst_ip="202.88.179.236" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.950980,1.494350,503,1 1 1 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="202.88.184.72" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.739200,1.609760,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="199.3.221.234" src_port="5425" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1425358800"/>
        <to usec="0" sec="1425358846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.599390,1.358320,504,1 1 1 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="145.164.106.119" dst_ip="110.74.15.3" src_port="65139" dst_port="443"/>
            <filter src_ip="148.165.135.119" dst_ip="110.74.15.3" src_port="54667" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.995770,1.618300,999,1 1 1 0 0 0 1 0 0 1 1 0,ntscUDP">
        <slice>
            <filter src_ip="97.12.173.4" src_port="5108" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.599390,1.358320,999,1 1 1 0 0 0 0 0 0 1 1 0,ipv46tun">
        <slice>
            <filter src_ip="202.88.184.62" dst_ip="171.49.111.108" src_port="21521" dst_port="411"/>
            <filter src_ip="202.88.184.62" dst_ip="130.52.237.254"/>
            <filter src_ip="202.88.184.62" dst_ip="210.166.31.242"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.288480,2.773110,020,1 1 1 0 0 0 1 1 0 1 1 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="219.240.35.238"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.463380,2.957110,010,1 1 0 1 1 1 1 1 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="202.88.178.253" dst_port="80"/>
            <filter dst_ip="202.88.188.166" dst_port="80"/>
            <filter dst_ip="202.88.188.188" dst_port="80"/>
        </slice>
        <from usec="0" sec="1425358800"/>
        <to usec="0" sec="1425359701"/>
    </anomaly>
    <anomaly type="anomalous" value="2.337130,1.791510,503,1 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="148.165.181.249" src_port="443"/>
            <filter dst_ip="148.165.181.249" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.385540,1.330330,020,1 1 1 1 0 0 0 0 0 1 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="63.1.37.65"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.808510,1.684610,901,0 0 0 1 1 1 0 0 0 0 0 0,ttl_error">
        <slice>
            <filter src_ip="0.0.0.0" dst_ip="187.102.77.133"/>
        </slice>
        <from usec="0" sec="1425358800"/>
        <to usec="0" sec="1425359628"/>
    </anomaly>
    <anomaly type="anomalous" value="2.331970,1.808940,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.178.153.75"/>
            <filter dst_ip="203.189.5.92" src_port="80"/>
            <filter dst_ip="203.189.5.92" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.337130,1.791510,504,1 0 0 1 1 1 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="77.86.229.80" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.331970,1.808940,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="202.88.179.236" dst_ip="193.108.9.71" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.808510,1.684610,503,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="86.140.122.145" dst_ip="187.102.78.113" src_port="80"/>
        </slice>
        <from usec="0" sec="1425359002"/>
        <to usec="0" sec="1425359264"/>
    </anomaly>
    <anomaly type="anomalous" value="1.822900,1.458620,010,1 0 1 0 0 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="47.25.61.67" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.905680,2.679190,010,0 0 0 0 0 0 1 1 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="202.88.188.166" dst_port="80"/>
        </slice>
        <from usec="0" sec="1425359610"/>
        <to usec="0" sec="1425359701"/>
    </anomaly>
    <anomaly type="anomalous" value="3.263360,2.755670,010,0 0 0 1 0 0 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="47.25.61.67" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.270230,1.192490,504,1 1 0 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="145.164.206.157" dst_port="80"/>
            <filter src_ip="145.164.206.157" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.542210,1.305590,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="148.182.136.113" dst_port="443"/>
            <filter dst_ip="4.107.44.183" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.270230,1.192490,504,1 1 0 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="148.165.114.65" dst_port="443"/>
            <filter src_ip="148.165.114.65" dst_ip="151.135.65.112" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.554850,1.298390,020,1 0 0 1 0 0 0 0 0 1 1 1,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="92.140.221.81" src_port="1433"/>
            <filter dst_ip="97.12.173.4"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.056450,1.692770,504,0 0 0 1 1 1 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="59.185.25.232" dst_ip="148.165.154.166" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.056450,1.692770,504,0 0 0 1 1 1 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="7.8.41.22" dst_ip="187.102.238.104" src_port="443" dst_port="51060"/>
            <filter src_ip="7.8.41.22" dst_ip="187.102.238.104" src_port="443" dst_port="51059"/>
            <filter src_ip="7.8.41.22" dst_ip="187.102.226.243" src_port="443" dst_port="51313"/>
            <filter src_ip="7.8.41.22" dst_ip="187.102.237.126" src_port="443" dst_port="52485"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.337130,1.791510,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="202.88.184.72" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.337130,1.791510,999,1 0 0 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="202.88.183.184" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.547090,1.322340,504,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="153.112.170.60" src_port="443"/>
            <filter dst_ip="145.164.114.12" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.331970,1.808940,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter src_ip="193.236.241.203" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.617430,1.938240,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="219.240.35.238" dst_port="3306"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.876800,2.128530,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="37.177.126.65" src_port="9090" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.940920,1.500610,010,1 1 1 0 0 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="116.239.117.137" src_port="12200" dst_port="1080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.467450,2.845510,010,1 1 1 0 0 0 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="92.140.221.81" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.534380,1.329410,999,0 0 0 0 0 0 0 0 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="99.121.253.121" dst_ip="129.76.188.148" src_port="59379" dst_port="8539"/>
            <filter src_ip="99.121.253.121" dst_ip="129.76.188.148" src_port="59332" dst_port="8539"/>
            <filter src_ip="99.121.253.121" dst_ip="129.76.188.148" src_port="59156" dst_port="8539"/>
            <filter src_ip="99.121.253.121" dst_ip="129.76.188.148" src_port="32425" dst_port="10183"/>
            <filter src_ip="99.121.253.121" dst_ip="129.76.188.148" src_port="11086" dst_port="8539"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.331970,1.808940,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="187.102.78.115" src_port="80"/>
            <filter dst_ip="187.102.78.115" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.547090,1.322340,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="148.179.83.188" src_port="80"/>
            <filter src_ip="69.83.16.136" dst_ip="148.179.83.188" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.542210,1.305590,503,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="7.8.41.133" src_port="80"/>
            <filter dst_ip="203.189.135.10" src_port="80"/>
            <filter dst_ip="203.189.135.10" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.542210,1.305590,999,1 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="202.88.183.184" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.453510,1.333240,503,0 0 0 1 0 0 0 0 0 0 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="129.76.115.247" src_port="80"/>
            <filter dst_ip="129.76.115.247" dst_port="6204"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
