<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.236420,1.431810,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="158.203.24.21" dst_ip="223.3.1.137" src_port="35389" dst_port="80"/>
        </slice>
        <from usec="0" sec="1428123735"/>
        <to usec="0" sec="1428124393"/>
    </anomaly>
    <anomaly type="suspicious" value="1.236420,1.431810,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="162.79.133.86" dst_ip="223.54.124.147" src_port="50227" dst_port="443"/>
            <filter src_ip="162.79.133.86" dst_ip="223.54.124.147" src_port="50226" dst_port="443"/>
        </slice>
        <from usec="0" sec="1428123621"/>
        <to usec="0" sec="1428123624"/>
    </anomaly>
    <anomaly type="suspicious" value="1.236420,1.431810,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="191.106.74.158" dst_ip="80.53.239.234" dst_port="443"/>
        </slice>
        <from usec="0" sec="1428123737"/>
        <to usec="0" sec="1428123809"/>
    </anomaly>
    <anomaly type="suspicious" value="1.236420,1.431810,504,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="56.116.186.151" dst_port="443"/>
        </slice>
        <from usec="0" sec="1428123792"/>
        <to usec="0" sec="1428124107"/>
    </anomaly>
    <anomaly type="suspicious" value="1.236420,1.431810,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="204.221.161.107" dst_port="23"/>
        </slice>
        <from usec="0" sec="1428124090"/>
        <to usec="0" sec="1428124114"/>
    </anomaly>
    <anomaly type="suspicious" value="1.236420,1.431810,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="18.55.114.202" dst_port="23"/>
        </slice>
        <from usec="0" sec="1428124443"/>
        <to usec="0" sec="1428124454"/>
    </anomaly>
    <anomaly type="suspicious" value="1.236420,1.431810,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="210.149.48.156" dst_port="23"/>
        </slice>
        <from usec="0" sec="1428124093"/>
        <to usec="0" sec="1428124114"/>
    </anomaly>
    <anomaly type="suspicious" value="1.344070,1.400680,504,1 1 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="191.106.84.244" dst_port="443"/>
            <filter dst_ip="201.137.192.198" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.970038,1.308770,503,1 0 0 1 0 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="205.56.213.97" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.967208,1.294940,503,0 0 0 1 1 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="205.56.218.155" dst_ip="221.154.204.66" src_port="80" dst_port="51322"/>
            <filter src_ip="205.56.218.155" dst_ip="221.154.204.66" src_port="80" dst_port="51321"/>
            <filter src_ip="205.56.218.155" dst_ip="221.154.204.66" src_port="80" dst_port="51320"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927954,1.366390,999,0 0 0 1 1 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="175.217.36.186" dst_port="53"/>
        </slice>
        <from usec="0" sec="1428123600"/>
        <to usec="0" sec="1428124428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.110710,1.291890,020,1 0 0 1 1 0 0 0 0 1 0 0,icmp_error">
        <slice>
            <filter src_ip="205.56.218.140" dst_ip="65.58.90.155" src_port="22"/>
            <filter src_ip="205.56.218.140"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.967208,1.294940,503,0 0 0 1 1 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="16.45.152.159" dst_ip="158.203.113.188" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927954,1.366390,999,0 0 0 1 1 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="204.46.135.105" dst_port="53"/>
        </slice>
        <from usec="0" sec="1428123600"/>
        <to usec="0" sec="1428124068"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927954,1.366390,503,0 0 0 1 1 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="204.175.252.37" src_port="80"/>
        </slice>
        <from usec="0" sec="1428123600"/>
        <to usec="0" sec="1428124428"/>
    </anomaly>
    <anomaly type="suspicious" value="0.967208,1.294940,503,0 0 0 1 1 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="191.106.40.116" dst_ip="139.72.218.23" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.982109,1.307890,503,1 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="205.56.221.1"/>
        </slice>
        <from usec="0" sec="1428123616"/>
        <to usec="0" sec="1428124388"/>
    </anomaly>
    <anomaly type="suspicious" value="1.195170,1.348150,503,1 0 0 1 1 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="195.141.97.60" src_port="443"/>
            <filter dst_ip="204.46.57.174" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927954,1.366390,999,0 0 0 1 1 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="175.217.191.168" dst_port="53"/>
        </slice>
        <from usec="0" sec="1428123600"/>
        <to usec="0" sec="1428124338"/>
    </anomaly>
    <anomaly type="suspicious" value="0.967208,1.294940,504,0 0 0 1 1 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="205.56.210.45" dst_ip="221.203.79.8" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927954,1.366390,020,0 0 0 1 1 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="186.135.26.76"/>
        </slice>
        <from usec="0" sec="1428123600"/>
        <to usec="0" sec="1428124321"/>
    </anomaly>
    <anomaly type="suspicious" value="0.927954,1.366390,999,0 0 0 1 1 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="186.135.28.16" src_port="53"/>
        </slice>
        <from usec="0" sec="1428123600"/>
        <to usec="0" sec="1428124321"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858820,1.269200,503,1 0 0 0 0 0 0 0 0 1 0 0,malphfl">
        <slice>
            <filter src_ip="186.135.166.66" dst_ip="182.126.49.64" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.195170,1.348150,504,1 0 0 1 1 0 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="204.32.185.206" dst_port="53"/>
            <filter src_ip="204.32.185.206" dst_port="443"/>
            <filter src_ip="204.32.185.206" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.063130,1.351080,999,0 0 0 1 1 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="204.46.159.173" dst_ip="23.249.33.48"/>
            <filter src_ip="204.46.159.173" dst_port="53"/>
            <filter dst_ip="23.249.33.48" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858820,1.269200,504,1 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="191.106.100.3" src_port="80"/>
            <filter dst_ip="191.106.100.3" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858820,1.269200,504,1 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="186.135.30.166" dst_port="443"/>
            <filter dst_ip="186.135.30.166" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.965568,1.326430,999,1 0 0 0 0 0 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="186.135.31.76" dst_port="993"/>
            <filter dst_ip="186.135.31.76" dst_port="143"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858820,1.269200,503,1 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="175.217.77.119" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.195170,1.348150,010,1 0 0 1 1 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="12.98.217.220" src_port="42179" dst_port="8888"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858820,1.269200,504,1 0 0 0 0 0 0 0 0 1 0 0,point_to_point">
        <slice>
            <filter src_ip="158.203.20.78" dst_ip="56.116.189.114" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858820,1.269200,503,1 0 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="186.135.212.130" dst_ip="29.108.32.59"/>
            <filter src_ip="186.135.212.130" dst_port="80"/>
            <filter src_ip="204.46.137.38" dst_ip="29.108.32.59" dst_port="80"/>
            <filter src_ip="186.135.212.188" dst_ip="29.108.32.59" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="119.34.90.80" dst_ip="175.217.195.215" src_port="80" dst_port="57274"/>
        </slice>
        <from usec="0" sec="1428124360"/>
        <to usec="0" sec="1428124480"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="113.245.204.18" dst_port="23"/>
        </slice>
        <from usec="0" sec="1428123735"/>
        <to usec="0" sec="1428123760"/>
    </anomaly>
    <anomaly type="anomalous" value="1.781100,1.605660,503,1 1 1 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="158.203.113.134" src_port="80"/>
            <filter src_ip="74.136.197.1" dst_ip="158.203.113.134" src_port="32010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="34.158.140.66" src_port="12200" dst_port="21320"/>
            <filter src_ip="34.158.140.66" src_port="12200" dst_port="80"/>
            <filter src_ip="34.158.140.66" src_port="12200" dst_port="443"/>
        </slice>
        <from usec="0" sec="1428123630"/>
        <to usec="0" sec="1428123635"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,504,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="223.54.104.240" dst_ip="191.106.190.193" src_port="443" dst_port="65473"/>
            <filter src_ip="223.54.104.240" dst_ip="191.106.190.193" src_port="443" dst_port="65472"/>
        </slice>
        <from usec="0" sec="1428124131"/>
        <to usec="0" sec="1428124133"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="65.106.71.233" dst_port="23"/>
        </slice>
        <from usec="0" sec="1428124032"/>
        <to usec="0" sec="1428124038"/>
    </anomaly>
    <anomaly type="anomalous" value="2.939900,2.257690,503,1 1 0 1 1 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="175.217.79.29" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,999,1 1 1 0 0 0 0 0 0 0 0 0,ipv4gretun">
        <slice>
            <filter src_ip="205.56.218.5" dst_ip="201.102.104.147"/>
        </slice>
        <from usec="0" sec="1428123660"/>
        <to usec="0" sec="1428124445"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="204.221.161.38" dst_port="23"/>
        </slice>
        <from usec="0" sec="1428124381"/>
        <to usec="0" sec="1428124393"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.14.118.43" src_port="29659" dst_port="8088"/>
        </slice>
        <from usec="0" sec="1428124050"/>
        <to usec="0" sec="1428124052"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="13.120.255.13" src_port="2001" dst_port="80"/>
        </slice>
        <from usec="0" sec="1428123639"/>
        <to usec="0" sec="1428124345"/>
    </anomaly>
    <anomaly type="anomalous" value="1.841370,1.650580,010,1 1 1 1 1 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="30.83.132.251" src_port="12200" dst_port="21320"/>
        </slice>
        <from usec="0" sec="1428123600"/>
        <to usec="0" sec="1428124068"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,002,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="209.179.57.159" src_port="50692" dst_port="137"/>
        </slice>
        <from usec="0" sec="1428124077"/>
        <to usec="0" sec="1428124079"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="64.242.143.140" dst_port="22"/>
        </slice>
        <from usec="0" sec="1428123720"/>
        <to usec="0" sec="1428123722"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="73.58.15.224" dst_port="23"/>
        </slice>
        <from usec="0" sec="1428124362"/>
        <to usec="0" sec="1428124377"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,502,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="214.90.231.16" dst_port="22"/>
        </slice>
        <from usec="0" sec="1428124106"/>
        <to usec="0" sec="1428124444"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="18.102.72.199" dst_port="23"/>
        </slice>
        <from usec="0" sec="1428124443"/>
        <to usec="0" sec="1428124445"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="80.103.116.95" dst_port="23"/>
        </slice>
        <from usec="0" sec="1428123986"/>
        <to usec="0" sec="1428124000"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="103.38.178.107" dst_port="23"/>
        </slice>
        <from usec="0" sec="1428124123"/>
        <to usec="0" sec="1428124133"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="113.244.200.38" dst_port="139"/>
        </slice>
        <from usec="0" sec="1428123728"/>
        <to usec="0" sec="1428123778"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="143.63.231.128" dst_port="23"/>
        </slice>
        <from usec="0" sec="1428123771"/>
        <to usec="0" sec="1428123785"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="72.104.125.76" dst_port="23"/>
        </slice>
        <from usec="0" sec="1428123619"/>
        <to usec="0" sec="1428123634"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="77.14.118.43" src_port="8088" dst_port="29659"/>
        </slice>
        <from usec="0" sec="1428124049"/>
        <to usec="0" sec="1428124051"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="142.169.136.161" src_port="1433" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1428124258"/>
        <to usec="0" sec="1428124260"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="75.162.180.85"/>
        </slice>
        <from usec="0" sec="1428123660"/>
        <to usec="0" sec="1428123667"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701330,1.632880,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="18.102.72.199"/>
        </slice>
        <from usec="0" sec="1428124443"/>
        <to usec="0" sec="1428124445"/>
    </anomaly>
    <anomaly type="anomalous" value="2.409440,1.875790,502,1 1 1 1 1 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="211.67.45.66" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.346070,1.899750,020,1 1 1 0 0 0 1 0 0 1 1 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="12.98.217.220"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.703870,1.618570,502,1 1 1 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="143.28.125.63" dst_port="22"/>
        </slice>
        <from usec="0" sec="1428124036"/>
        <to usec="0" sec="1428124372"/>
    </anomaly>
    <anomaly type="anomalous" value="3.852890,3.132260,503,1 0 0 1 1 1 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="191.106.98.154" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.901950,2.640190,503,1 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="31.102.135.27" dst_ip="158.203.24.21" src_port="10846" dst_port="443"/>
            <filter src_ip="223.3.1.137" dst_ip="158.203.24.21" src_port="80" dst_port="35389"/>
        </slice>
        <from usec="0" sec="1428123600"/>
        <to usec="0" sec="1428124246"/>
    </anomaly>
    <anomaly type="anomalous" value="2.626880,2.108660,503,1 0 0 1 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="205.56.210.32" dst_ip="196.55.4.254" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.814000,3.133520,999,0 0 0 1 1 1 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="205.56.215.34" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.514590,1.437550,504,1 1 0 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="158.203.112.90" dst_port="80"/>
            <filter src_ip="158.203.153.198" dst_port="443"/>
            <filter dst_ip="56.116.178.165" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.896940,2.633790,999,0 0 0 1 1 1 0 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="205.56.215.8" dst_ip="65.101.222.70" src_port="58290" dst_port="6724"/>
            <filter src_ip="205.56.215.8" dst_ip="65.101.222.70" src_port="55006" dst_port="6698"/>
            <filter src_ip="205.56.215.8" dst_ip="65.101.222.70" src_port="44474" dst_port="6705"/>
            <filter src_ip="205.56.215.8" dst_ip="65.101.222.70" src_port="3001" dst_port="6689"/>
            <filter src_ip="205.56.215.10" dst_ip="65.101.222.70"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.757630,1.677750,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="30.83.133.138" src_port="12200" dst_port="443"/>
        </slice>
        <from usec="0" sec="1428123600"/>
        <to usec="0" sec="1428124419"/>
    </anomaly>
    <anomaly type="anomalous" value="1.963290,1.682650,010,1 1 1 1 1 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="106.12.108.104" src_port="57364" dst_port="21"/>
            <filter src_ip="148.130.186.22" src_port="57157" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.814000,3.133520,999,0 0 0 1 1 1 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="205.56.215.34" dst_ip="151.196.214.196" src_port="40277" dst_port="1282"/>
            <filter src_ip="205.56.215.34" dst_ip="151.196.214.196" src_port="37686" dst_port="1277"/>
            <filter src_ip="205.56.215.34" dst_ip="151.196.214.196" src_port="37549" dst_port="1297"/>
            <filter src_ip="205.56.215.34" dst_ip="151.196.214.196" src_port="3001" dst_port="1273"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.913050,1.637920,010,1 1 1 1 1 0 0 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="22.174.201.10" dst_port="22"/>
            <filter src_ip="73.188.244.157" src_port="6000" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.449520,1.914980,010,1 1 1 1 1 0 1 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="216.190.163.58" dst_port="8080"/>
            <filter src_ip="208.16.234.30" src_port="6000" dst_port="22222"/>
            <filter src_ip="12.98.217.220" src_port="43785" dst_port="8888"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.237460,4.406880,010,1 1 1 1 1 0 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="140.168.27.40" dst_port="1723"/>
            <filter src_ip="68.9.13.88"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.612670,4.066750,010,1 1 1 1 1 0 1 1 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="22.174.201.11" dst_port="22"/>
            <filter src_ip="142.169.136.161" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.852890,3.132260,504,1 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="205.56.221.52" src_port="80"/>
            <filter src_ip="51.131.1.22" dst_ip="205.56.221.52" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.841370,1.650580,502,1 1 1 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="214.90.229.37" dst_port="22"/>
        </slice>
        <from usec="0" sec="1428124040"/>
        <to usec="0" sec="1428124447"/>
    </anomaly>
    <anomaly type="anomalous" value="1.834960,1.651270,999,1 1 1 1 0 0 1 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="175.217.126.252" src_port="53"/>
            <filter dst_ip="175.217.126.252" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.155820,3.290120,999,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.605460,2.156250,503,0 0 0 0 0 0 1 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="196.55.4.254" dst_ip="205.56.210.32" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.249280,3.933760,010,0 0 0 0 0 0 1 1 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="205.56.221.1" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.698000,1.564190,504,1 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="204.46.155.5" dst_ip="1.195.115.186" src_port="63818" dst_port="443"/>
            <filter src_ip="204.46.155.5" dst_ip="1.195.115.186" src_port="63817" dst_port="443"/>
            <filter src_ip="204.46.155.5" dst_ip="1.195.115.186" src_port="63811" dst_port="80"/>
            <filter src_ip="204.46.155.5" dst_ip="1.195.115.186" src_port="63810" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.753670,2.167860,503,1 0 0 1 1 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="204.32.185.206" src_port="80"/>
            <filter dst_ip="204.32.185.206" src_port="53"/>
            <filter dst_ip="204.32.185.206" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.607800,1.566720,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="195.75.76.57" dst_ip="191.106.84.244" src_port="443"/>
            <filter src_ip="195.75.76.57" dst_ip="191.106.84.244" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.569500,2.110530,999,0 0 0 1 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="112.140.245.112" dst_ip="205.56.215.58"/>
            <filter src_ip="112.140.245.112" dst_port="3001"/>
            <filter dst_ip="205.56.215.58" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.698000,1.564190,503,1 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="158.203.114.39" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.610490,1.551790,503,0 0 0 1 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="204.46.155.5" src_port="80"/>
            <filter src_ip="51.131.34.180" dst_ip="204.46.155.5" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.567810,2.121530,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="122.7.168.178" dst_ip="158.203.112.94" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.607800,1.566720,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="204.33.59.103" dst_ip="186.135.119.170" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.607800,1.566720,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="158.203.155.102" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.607800,1.566720,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="12.195.224.132" dst_ip="158.203.55.217" src_port="80"/>
            <filter src_ip="12.195.224.185" dst_ip="158.203.55.217" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.567810,2.121530,999,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="205.56.215.8" dst_ip="221.31.132.93" src_port="57885" dst_port="53613"/>
            <filter src_ip="205.56.215.8" dst_ip="221.31.132.93" src_port="53447" dst_port="53611"/>
            <filter src_ip="205.56.215.8" dst_ip="221.31.132.93" src_port="50879" dst_port="53612"/>
            <filter src_ip="205.56.215.8" dst_ip="221.31.132.93" src_port="3001" dst_port="53610"/>
            <filter src_ip="205.56.215.10" dst_ip="221.31.132.93"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.607800,1.566720,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="204.46.155.5" dst_ip="1.195.118.195" src_port="63807" dst_port="80"/>
            <filter src_ip="204.46.155.5" dst_ip="1.195.118.195" src_port="63806" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
