<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.078900,1.445720,504,1 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="196.125.94.146" src_port="80"/>
            <filter dst_ip="196.125.94.146" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.302850,1.516140,011,1 1 1 0 0 0 0 0 0 1 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="210.116.241.113" src_port="1433" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.988705,1.469190,012,1 1 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="196.125.92.144" src_port="80"/>
            <filter src_ip="196.125.92.145" src_port="80"/>
        </slice>
        <from usec="0" sec="1433566836"/>
        <to usec="0" sec="1433567628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.276580,1.524910,503,1 0 0 0 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="13.127.108.19" src_port="80"/>
            <filter dst_ip="197.2.194.11" src_port="80"/>
            <filter dst_ip="197.2.194.11" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.603840,1.685400,504,1 1 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="170.69.226.229" dst_port="443"/>
            <filter src_ip="170.69.226.230" dst_port="443"/>
            <filter dst_ip="193.4.3.216" dst_port="443"/>
        </slice>
        <from usec="0" sec="1433566801"/>
        <to usec="0" sec="1433567700"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073360,1.519730,020,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="36.24.231.1"/>
        </slice>
        <from usec="0" sec="1433567371"/>
        <to usec="0" sec="1433567701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.988705,1.469190,999,1 1 0 1 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="203.222.29.66"/>
        </slice>
        <from usec="0" sec="1433566801"/>
        <to usec="0" sec="1433567670"/>
    </anomaly>
    <anomaly type="suspicious" value="1.603840,1.685400,010,1 1 0 1 1 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="209.183.144.76" dst_port="23"/>
        </slice>
        <from usec="0" sec="1433567544"/>
        <to usec="0" sec="1433567560"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073360,1.519730,020,1 1 1 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="116.120.13.22"/>
        </slice>
        <from usec="0" sec="1433567566"/>
        <to usec="0" sec="1433567612"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073360,1.519730,020,1 1 1 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="65.112.31.209"/>
        </slice>
        <from usec="0" sec="1433567566"/>
        <to usec="0" sec="1433567612"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073360,1.519730,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="129.77.234.121" dst_port="23"/>
        </slice>
        <from usec="0" sec="1433566801"/>
        <to usec="0" sec="1433566989"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073360,1.519730,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="16.153.130.41" src_port="12200" dst_port="80"/>
            <filter src_ip="16.153.130.41" src_port="12200" dst_port="8118"/>
            <filter src_ip="16.153.130.41" src_port="12200" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1433567156"/>
        <to usec="0" sec="1433567252"/>
    </anomaly>
    <anomaly type="suspicious" value="1.157460,1.452070,503,1 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="54.167.196.149" src_port="80"/>
            <filter dst_ip="138.159.16.192" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.529290,1.597590,999,1 1 1 1 0 0 1 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="78.146.94.64" src_port="46916" dst_port="5060"/>
            <filter src_ip="193.167.177.76" src_port="55403" dst_port="1900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.343630,1.530930,020,1 0 0 1 0 0 1 0 0 1 0 0,icmp_error">
        <slice>
            <filter src_ip="196.125.83.193"/>
            <filter dst_ip="87.107.24.102"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.988705,1.469190,999,1 1 0 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="197.14.35.113" dst_port="53"/>
        </slice>
        <from usec="0" sec="1433566801"/>
        <to usec="0" sec="1433567698"/>
    </anomaly>
    <anomaly type="suspicious" value="1.573020,1.706150,503,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="176.8.177.43" src_port="80"/>
            <filter dst_ip="138.159.208.73" src_port="80"/>
        </slice>
        <from usec="0" sec="1433566801"/>
        <to usec="0" sec="1433567614"/>
    </anomaly>
    <anomaly type="suspicious" value="1.516150,1.700750,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1433566801"/>
        <to usec="0" sec="1433567179"/>
    </anomaly>
    <anomaly type="suspicious" value="1.545690,1.673760,503,1 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="197.15.15.196" src_port="443"/>
            <filter src_ip="197.15.15.196" dst_ip="138.159.21.218" src_port="80"/>
            <filter src_ip="203.52.200.136" dst_ip="138.159.21.218" src_port="443"/>
        </slice>
        <from usec="0" sec="1433566801"/>
        <to usec="0" sec="1433567603"/>
    </anomaly>
    <anomaly type="suspicious" value="1.573020,1.706150,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="196.125.86.7" dst_ip="139.49.104.100" src_port="80"/>
        </slice>
        <from usec="0" sec="1433566802"/>
        <to usec="0" sec="1433567182"/>
    </anomaly>
    <anomaly type="suspicious" value="1.573020,1.706150,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="170.69.36.228" dst_ip="128.33.70.135" dst_port="80"/>
            <filter src_ip="138.159.23.152" dst_ip="128.33.70.135" dst_port="80"/>
            <filter src_ip="170.69.108.182" dst_ip="128.33.70.135" dst_port="80"/>
        </slice>
        <from usec="0" sec="1433566817"/>
        <to usec="0" sec="1433567619"/>
    </anomaly>
    <anomaly type="suspicious" value="1.573020,1.706150,020,0 0 0 1 1 0 0 0 0 0 0 0,ptpDoSIC">
        <slice>
            <filter src_ip="196.125.92.144" dst_ip="47.120.88.204"/>
        </slice>
        <from usec="0" sec="1433567131"/>
        <to usec="0" sec="1433567145"/>
    </anomaly>
    <anomaly type="suspicious" value="1.573020,1.706150,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="170.69.78.190" dst_ip="140.18.40.54" src_port="58306" dst_port="80"/>
            <filter src_ip="170.69.78.190" dst_ip="140.18.40.54" src_port="56367" dst_port="80"/>
            <filter src_ip="170.69.78.190" dst_ip="140.18.40.54" src_port="51279" dst_port="80"/>
            <filter src_ip="170.69.78.190" dst_ip="140.18.40.54" src_port="47350" dst_port="80"/>
            <filter src_ip="170.69.78.190" dst_ip="140.18.40.54" src_port="45619" dst_port="80"/>
        </slice>
        <from usec="0" sec="1433566930"/>
        <to usec="0" sec="1433567251"/>
    </anomaly>
    <anomaly type="suspicious" value="1.573020,1.706150,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="174.54.207.188" dst_ip="77.39.228.15" src_port="80" dst_port="56007"/>
            <filter src_ip="197.14.14.71" dst_ip="77.39.228.15" src_port="80" dst_port="50721"/>
            <filter src_ip="174.54.204.209" dst_ip="77.39.228.15" src_port="80" dst_port="58603"/>
        </slice>
        <from usec="0" sec="1433567076"/>
        <to usec="0" sec="1433567195"/>
    </anomaly>
    <anomaly type="suspicious" value="1.573020,1.706150,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="196.125.94.146" dst_ip="87.46.85.196" dst_port="80"/>
            <filter src_ip="10.10.0.156" dst_ip="87.46.85.196" dst_port="80"/>
        </slice>
        <from usec="0" sec="1433567080"/>
        <to usec="0" sec="1433567294"/>
    </anomaly>
    <anomaly type="suspicious" value="1.573020,1.706150,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="138.159.45.247" dst_ip="139.79.169.107" dst_port="80"/>
        </slice>
        <from usec="0" sec="1433567197"/>
        <to usec="0" sec="1433567246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.921070,1.939540,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1433566801"/>
        <to usec="0" sec="1433567179"/>
    </anomaly>
    <anomaly type="suspicious" value="1.346400,1.537680,502,1 1 0 0 0 0 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="160.147.8.185" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.309530,1.560390,010,0 0 0 0 0 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.107.24.101" src_port="60000" dst_port="636"/>
            <filter src_ip="87.107.24.101" src_port="60000" dst_port="60010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073360,1.519730,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="36.24.231.1" src_port="5062" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1433567341"/>
        <to usec="0" sec="1433567701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073360,1.519730,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="16.153.129.102" src_port="12200" dst_port="8118"/>
            <filter src_ip="16.153.129.102" src_port="12200" dst_port="80"/>
        </slice>
        <from usec="0" sec="1433567431"/>
        <to usec="0" sec="1433567477"/>
    </anomaly>
    <anomaly type="suspicious" value="1.117690,1.483100,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="26.65.46.111"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.117690,1.483100,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="7.97.33.232"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.117690,1.483100,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="175.6.162.14"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078900,1.445720,504,1 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="174.41.159.88" dst_ip="223.108.11.88" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.117690,1.483100,503,0 0 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="174.54.60.160"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.193700,1.489290,999,0 0 0 1 0 0 0 0 0 1 0 0,salphfl">
        <slice>
            <filter src_ip="173.39.83.47" dst_ip="196.125.94.146" src_port="995"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.309530,1.560390,010,0 0 0 0 0 0 1 0 0 1 0 0,DDoSSYN">
        <slice>
            <filter src_ip="176.14.76.244" dst_ip="184.186.134.245"/>
            <filter src_ip="176.14.76.244" dst_ip="184.186.134.241"/>
            <filter src_ip="176.14.76.244" dst_ip="184.186.134.242"/>
            <filter src_ip="176.14.76.244" dst_port="80"/>
            <filter dst_ip="184.186.134.245" dst_port="80"/>
            <filter dst_ip="184.186.134.241" dst_port="80"/>
            <filter dst_ip="184.186.134.242" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.117690,1.483100,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="126.169.135.92"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.117690,1.483100,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="131.227.91.25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.117690,1.483100,020,0 0 0 0 0 0 0 0 0 1 0 0,sptpDoSIC">
        <slice>
            <filter src_ip="206.222.212.190"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.117690,1.483100,502,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="197.14.34.218"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.234040,1.465480,503,1 1 0 1 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="196.125.93.79" dst_port="80"/>
            <filter src_ip="196.125.93.79" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.193700,1.489290,020,0 0 0 1 0 0 0 0 0 1 0 0,icmp_error">
        <slice>
            <filter src_ip="196.125.82.9"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.117690,1.483100,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="95.29.208.23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.117690,1.483100,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="13.91.153.156"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.117690,1.483100,503,0 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="176.8.6.186"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.451760,1.603170,503,1 0 0 0 0 0 0 0 0 0 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="138.159.22.207" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.152290,1.525770,999,1 1 1 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="139.63.121.62" src_port="5071" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1433566801"/>
        <to usec="0" sec="1433567536"/>
    </anomaly>
    <anomaly type="suspicious" value="1.117690,1.483100,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="131.227.91.26"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.117690,1.483100,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="64.94.167.254"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.117690,1.483100,503,0 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="138.159.22.207" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.012190,1.816630,504,1 1 0 1 1 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="197.2.194.11" dst_port="443"/>
            <filter src_ip="197.2.194.11" dst_port="80"/>
            <filter src_ip="197.14.14.39" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.786130,2.271980,503,1 1 1 0 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="176.8.197.125" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.524840,2.190110,999,1 1 1 1 1 1 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="223.120.150.167" src_port="47271" dst_port="123"/>
        </slice>
        <from usec="0" sec="1433566801"/>
        <to usec="0" sec="1433567595"/>
    </anomaly>
    <anomaly type="anomalous" value="1.985710,1.757050,999,1 1 0 1 0 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="138.159.23.163"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.603500,2.765660,503,1 1 1 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="196.125.93.126" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.667540,2.807860,503,1 1 1 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="176.8.197.158" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.802040,2.292620,010,1 1 1 1 1 1 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="210.116.217.101" src_port="6000" dst_port="5901"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.911010,1.732930,999,1 1 1 0 0 0 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="196.125.86.191" dst_ip="195.68.181.93"/>
            <filter src_ip="196.125.86.191" dst_ip="193.189.182.156"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.603500,2.765660,504,1 1 1 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="142.166.120.93" dst_ip="176.8.219.42" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.733600,2.223750,503,1 1 1 1 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="196.125.93.126" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.864780,1.688780,504,1 1 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="116.238.113.119" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.956440,1.738230,503,1 1 1 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="196.125.86.68" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.667540,2.807860,503,1 1 1 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="197.202.42.67" src_port="80"/>
            <filter dst_ip="197.202.42.67" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.866910,1.770670,504,0 0 0 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="184.186.205.145" src_port="443"/>
            <filter src_ip="88.63.55.8" dst_ip="184.186.80.86" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.667540,2.807860,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="210.116.241.113" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.434470,2.167370,504,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="126.196.204.111" dst_ip="176.8.39.124" src_port="443" dst_port="49354"/>
            <filter src_ip="19.49.91.7" dst_ip="176.8.39.124" src_port="40407" dst_port="25339"/>
        </slice>
        <from usec="0" sec="1433567027"/>
        <to usec="0" sec="1433567266"/>
    </anomaly>
    <anomaly type="anomalous" value="3.540770,2.747690,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="87.67.225.220" src_port="80"/>
            <filter dst_ip="138.159.64.144" src_port="80"/>
            <filter dst_ip="138.159.64.144" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.056190,2.392750,504,1 1 1 1 1 1 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="197.2.87.44" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.981970,2.371950,504,0 0 0 1 1 1 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="88.74.230.206" dst_ip="197.2.87.44" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.434470,2.167370,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="85.55.125.143" dst_ip="174.41.185.134" src_port="80" dst_port="64987"/>
            <filter src_ip="85.55.125.143" dst_ip="174.41.185.134" src_port="80" dst_port="64986"/>
            <filter src_ip="85.55.125.143" dst_ip="174.41.185.134" src_port="80" dst_port="64985"/>
            <filter src_ip="85.55.125.143" dst_ip="174.41.185.134" src_port="80" dst_port="64984"/>
            <filter src_ip="88.74.145.98" dst_ip="174.41.185.134" src_port="80" dst_port="64949"/>
        </slice>
        <from usec="0" sec="1433567052"/>
        <to usec="0" sec="1433567085"/>
    </anomaly>
    <anomaly type="anomalous" value="2.705180,2.246680,502,1 0 0 1 1 1 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="160.147.8.185" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.416900,2.141960,504,1 0 0 1 1 1 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="184.186.244.26" dst_ip="126.169.197.41" src_port="3323" dst_port="123"/>
            <filter src_ip="184.186.244.26" dst_ip="116.238.113.125" src_port="50115" dst_port="443"/>
            <filter src_ip="184.186.244.26" dst_ip="116.238.113.119" src_port="28074" dst_port="443"/>
        </slice>
        <from usec="0" sec="1433566802"/>
        <to usec="0" sec="1433567539"/>
    </anomaly>
    <anomaly type="anomalous" value="2.754620,2.238490,503,1 1 0 1 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="196.125.86.68" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.667540,2.807860,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="34.122.80.240" src_port="16063" dst_port="5900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="8.352730,7.733720,999,0 0 0 0 0 0 1 1 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="203.222.29.66" src_port="37120" dst_port="443"/>
            <filter src_ip="203.222.29.66" src_port="37119" dst_port="443"/>
            <filter src_ip="203.222.29.66"/>
        </slice>
        <from usec="0" sec="1433567431"/>
        <to usec="0" sec="1433567522"/>
    </anomaly>
    <anomaly type="anomalous" value="2.600670,2.172120,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="138.159.196.163" dst_ip="203.42.179.219"/>
            <filter src_ip="138.159.196.163" dst_port="443"/>
            <filter src_ip="174.54.97.145" dst_ip="203.42.179.219" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.838330,1.709490,503,0 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="138.159.207.173" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.528710,2.727690,504,1 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="138.159.45.5" src_port="443"/>
            <filter dst_ip="138.159.45.5" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.528710,2.727690,999,1 0 0 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="196.125.90.147" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.650350,2.201350,502,0 0 0 1 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="196.125.80.228" dst_ip="106.75.158.80" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.600670,2.172120,999,1 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="196.125.90.179" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.815010,1.677160,503,1 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="197.2.194.11" src_port="80"/>
            <filter dst_ip="197.2.194.11" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.981970,2.371950,999,0 0 0 1 1 1 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="11.141.201.212" dst_ip="196.125.90.147"/>
            <filter src_ip="11.141.201.212" dst_ip="196.125.90.169"/>
            <filter src_ip="11.141.201.212" dst_port="3001"/>
            <filter dst_ip="196.125.90.147" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.765940,1.671670,503,1 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="196.125.93.79" src_port="53"/>
            <filter dst_ip="196.125.93.79" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.754620,2.238490,503,1 1 0 1 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="197.14.14.39" src_port="53"/>
            <filter dst_ip="197.14.14.39" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.600670,2.172120,503,1 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="138.159.23.73" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.789910,1.704100,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="88.74.230.224" dst_ip="174.41.224.212" src_port="80" dst_port="50776"/>
            <filter src_ip="88.74.230.224" dst_ip="174.41.224.212" src_port="80" dst_port="50775"/>
            <filter src_ip="88.74.230.224" dst_ip="174.41.224.212" src_port="80" dst_port="50769"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.789910,1.704100,999,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="196.125.90.179" dst_ip="15.192.235.163" src_port="54370" dst_port="13339"/>
            <filter src_ip="196.125.90.179" dst_ip="15.192.235.163" src_port="44191" dst_port="13340"/>
            <filter src_ip="196.125.90.179" dst_ip="15.192.235.163" src_port="43773" dst_port="13341"/>
            <filter src_ip="196.125.90.179" dst_ip="15.192.235.163" src_port="3001" dst_port="13338"/>
            <filter src_ip="196.125.90.183" dst_ip="15.192.235.163"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.815010,1.677160,503,1 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="176.8.176.194" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.765940,1.671670,503,1 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="196.125.77.147" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.634230,2.176350,504,1 0 0 1 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="138.159.45.5" src_port="36698"/>
            <filter src_ip="138.159.45.5" dst_port="443"/>
            <filter src_ip="138.159.45.5" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.554570,2.734850,504,1 1 0 1 1 1 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="197.2.87.44" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.789910,1.704100,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="196.125.82.204" dst_ip="87.52.209.127" src_port="123" dst_port="17201"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
