<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.223120,1.352600,504,1 0 0 1 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="61.7.241.126" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.113.88.69" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245245"/>
        <to usec="0" sec="1436245264"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="178.146.251.187" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245552"/>
        <to usec="0" sec="1436245564"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.119.34.80" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436246066"/>
        <to usec="0" sec="1436246076"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="210.5.26.160" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245231"/>
        <to usec="0" sec="1436245242"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="25.98.146.83" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245578"/>
        <to usec="0" sec="1436245590"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="121.45.207.88" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245914"/>
        <to usec="0" sec="1436245937"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="129.106.27.162" dst_ip="48.98.62.37" src_port="43340" dst_port="80"/>
            <filter src_ip="129.106.27.162" dst_ip="48.98.62.37" src_port="40186" dst_port="80"/>
            <filter src_ip="129.106.27.162" dst_ip="48.98.62.37" src_port="13337" dst_port="80"/>
        </slice>
        <from usec="0" sec="1436245226"/>
        <to usec="0" sec="1436245946"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="180.155.82.82" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245702"/>
        <to usec="0" sec="1436245714"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,504,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="135.118.105.15" dst_ip="175.225.148.131" src_port="49455" dst_port="443"/>
        </slice>
        <from usec="0" sec="1436245619"/>
        <to usec="0" sec="1436246009"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.172.24.134" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245375"/>
        <to usec="0" sec="1436245386"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="114.190.149.18" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245447"/>
        <to usec="0" sec="1436245461"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="135.118.58.155" dst_ip="75.191.105.55" src_port="35063" dst_port="25"/>
        </slice>
        <from usec="0" sec="1436245573"/>
        <to usec="0" sec="1436245589"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,503,1 1 1 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.95.25.11" src_port="80"/>
        </slice>
        <from usec="0" sec="1436245254"/>
        <to usec="0" sec="1436245807"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="25.98.146.83"/>
        </slice>
        <from usec="0" sec="1436245578"/>
        <to usec="0" sec="1436245590"/>
    </anomaly>
    <anomaly type="suspicious" value="1.231200,1.368450,504,1 1 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="165.214.142.43" dst_ip="62.223.220.206" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="211.250.238.53" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245728"/>
        <to usec="0" sec="1436245757"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="116.114.201.53" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245419"/>
        <to usec="0" sec="1436245431"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="191.45.218.107" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245995"/>
        <to usec="0" sec="1436246019"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.250.235.202" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245766"/>
        <to usec="0" sec="1436245777"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="184.115.246.20" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245534"/>
        <to usec="0" sec="1436245547"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="184.210.11.226" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245579"/>
        <to usec="0" sec="1436245606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="33.43.216.114" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245732"/>
        <to usec="0" sec="1436245744"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="66.197.32.245" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245908"/>
        <to usec="0" sec="1436245922"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="172.186.119.91" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245210"/>
        <to usec="0" sec="1436245221"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="14.93.238.137" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245953"/>
        <to usec="0" sec="1436245964"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="86.187.77.239" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245816"/>
        <to usec="0" sec="1436245829"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.137.103.172" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245624"/>
        <to usec="0" sec="1436245645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="89.216.195.246" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245472"/>
        <to usec="0" sec="1436245476"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="25.58.122.231" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245589"/>
        <to usec="0" sec="1436245592"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="188.6.253.187" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245508"/>
        <to usec="0" sec="1436245521"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="183.78.8.207" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245218"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="100.96.5.254" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245870"/>
        <to usec="0" sec="1436245882"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="189.44.174.253" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245997"/>
        <to usec="0" sec="1436246009"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="121.60.179.182" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245939"/>
        <to usec="0" sec="1436245951"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="100.227.218.158" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245425"/>
        <to usec="0" sec="1436245438"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="119.16.28.250" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245650"/>
        <to usec="0" sec="1436245664"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="65.111.60.225" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245621"/>
        <to usec="0" sec="1436245636"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="119.16.227.183" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245273"/>
        <to usec="0" sec="1436245285"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.228.119.15" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245583"/>
        <to usec="0" sec="1436245608"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="121.34.97.65" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245703"/>
        <to usec="0" sec="1436245725"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="188.223.65.249" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245818"/>
        <to usec="0" sec="1436245832"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="176.21.18.235" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245841"/>
        <to usec="0" sec="1436245874"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="169.105.89.166" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245682"/>
        <to usec="0" sec="1436245710"/>
    </anomaly>
    <anomaly type="suspicious" value="1.172270,1.473790,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="64.139.162.63" src_port="12200" dst_port="1095"/>
            <filter src_ip="64.139.162.63" src_port="12200" dst_port="60088"/>
            <filter src_ip="64.139.162.63" src_port="12200" dst_port="1080"/>
        </slice>
        <from usec="0" sec="1436245471"/>
        <to usec="0" sec="1436245553"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="86.163.168.151" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245277"/>
        <to usec="0" sec="1436245291"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.148.36.192" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436246072"/>
        <to usec="0" sec="1436246084"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="181.39.143.80" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245231"/>
        <to usec="0" sec="1436245244"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="205.13.183.115" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245741"/>
        <to usec="0" sec="1436245753"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="188.42.93.225" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245652"/>
        <to usec="0" sec="1436245664"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="191.208.203.161" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436246062"/>
        <to usec="0" sec="1436246065"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="128.150.8.47" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245320"/>
        <to usec="0" sec="1436245335"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="180.97.52.37" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245860"/>
        <to usec="0" sec="1436245867"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="191.164.96.228" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245228"/>
        <to usec="0" sec="1436245252"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="119.16.74.223" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245228"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="172.147.61.62" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245719"/>
        <to usec="0" sec="1436245759"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="119.31.220.253" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245440"/>
        <to usec="0" sec="1436245458"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="188.41.61.19" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245603"/>
        <to usec="0" sec="1436245623"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="90.51.199.229" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245399"/>
        <to usec="0" sec="1436245412"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="125.218.83.118" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245453"/>
        <to usec="0" sec="1436245464"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="116.119.50.56" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245566"/>
        <to usec="0" sec="1436245578"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="125.218.222.162" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245978"/>
        <to usec="0" sec="1436245997"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="121.50.196.229" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245647"/>
        <to usec="0" sec="1436245651"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="80.70.116.228" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245989"/>
        <to usec="0" sec="1436246004"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.38.51.245" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245718"/>
        <to usec="0" sec="1436245730"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="100.226.244.75" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436246039"/>
        <to usec="0" sec="1436246055"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="114.33.144.146" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245891"/>
        <to usec="0" sec="1436245903"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="125.202.185.124" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245991"/>
        <to usec="0" sec="1436246004"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="87.119.34.80"/>
        </slice>
        <from usec="0" sec="1436246065"/>
        <to usec="0" sec="1436246082"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="89.216.195.246"/>
        </slice>
        <from usec="0" sec="1436245472"/>
        <to usec="0" sec="1436245476"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="25.58.122.231"/>
        </slice>
        <from usec="0" sec="1436245590"/>
        <to usec="0" sec="1436245593"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="121.41.202.154"/>
        </slice>
        <from usec="0" sec="1436245344"/>
        <to usec="0" sec="1436245354"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="66.145.53.229"/>
        </slice>
        <from usec="0" sec="1436245505"/>
        <to usec="0" sec="1436245508"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="180.97.52.37"/>
        </slice>
        <from usec="0" sec="1436245860"/>
        <to usec="0" sec="1436245867"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="116.113.159.61"/>
        </slice>
        <from usec="0" sec="1436245638"/>
        <to usec="0" sec="1436245645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.172270,1.473790,020,1 1 1 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="189.192.200.174"/>
        </slice>
        <from usec="0" sec="1436245246"/>
        <to usec="0" sec="1436245292"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="176.21.18.235"/>
        </slice>
        <from usec="0" sec="1436245841"/>
        <to usec="0" sec="1436245874"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="65.111.116.249"/>
        </slice>
        <from usec="0" sec="1436245751"/>
        <to usec="0" sec="1436245764"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="178.146.251.187"/>
        </slice>
        <from usec="0" sec="1436245552"/>
        <to usec="0" sec="1436245567"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="119.26.162.153"/>
        </slice>
        <from usec="0" sec="1436245516"/>
        <to usec="0" sec="1436245520"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="0.251.160.48"/>
        </slice>
        <from usec="0" sec="1436245337"/>
        <to usec="0" sec="1436245343"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="188.42.47.207"/>
        </slice>
        <from usec="0" sec="1436246028"/>
        <to usec="0" sec="1436246036"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="89.57.120.187"/>
        </slice>
        <from usec="0" sec="1436245438"/>
        <to usec="0" sec="1436245440"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="127.50.188.27"/>
        </slice>
        <from usec="0" sec="1436245997"/>
        <to usec="0" sec="1436246003"/>
    </anomaly>
    <anomaly type="suspicious" value="1.172270,1.473790,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="48.145.9.184" src_port="12200" dst_port="3128"/>
            <filter src_ip="48.145.9.184" src_port="12200" dst_port="21320"/>
        </slice>
        <from usec="0" sec="1436245651"/>
        <to usec="0" sec="1436245697"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="128.138.21.82" dst_ip="218.142.150.232" src_port="28367" dst_port="25"/>
        </slice>
        <from usec="0" sec="1436245618"/>
        <to usec="0" sec="1436245625"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="47.200.223.113" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245860"/>
        <to usec="0" sec="1436245883"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="195.15.81.28" dst_port="25"/>
            <filter src_ip="195.15.81.28" dst_ip="64.121.145.5" src_port="22"/>
        </slice>
        <from usec="0" sec="1436245213"/>
        <to usec="0" sec="1436246056"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="116.114.194.43" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245389"/>
        <to usec="0" sec="1436245400"/>
    </anomaly>
    <anomaly type="suspicious" value="1.090830,1.442650,999,1 1 1 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="202.203.254.174" dst_port="5666"/>
            <filter src_ip="202.203.254.174" dst_ip="194.180.34.150" dst_port="161"/>
        </slice>
        <from usec="0" sec="1436245202"/>
        <to usec="0" sec="1436245925"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="188.222.154.191" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245883"/>
        <to usec="0" sec="1436245909"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="125.144.168.163" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245700"/>
        <to usec="0" sec="1436245712"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="64.139.165.72" src_port="12200" dst_port="3128"/>
            <filter src_ip="64.139.165.72" src_port="12200" dst_port="8118"/>
            <filter src_ip="64.139.165.72" src_port="12200" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1436245745"/>
        <to usec="0" sec="1436245756"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="116.115.215.234" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245487"/>
        <to usec="0" sec="1436245489"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="119.19.63.33"/>
        </slice>
        <from usec="0" sec="1436246065"/>
        <to usec="0" sec="1436246071"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="81.13.105.203"/>
        </slice>
        <from usec="0" sec="1436245477"/>
        <to usec="0" sec="1436245487"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="86.187.77.239"/>
        </slice>
        <from usec="0" sec="1436245816"/>
        <to usec="0" sec="1436245829"/>
    </anomaly>
    <anomaly type="suspicious" value="1.014790,1.446780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="191.208.203.161"/>
        </slice>
        <from usec="0" sec="1436246062"/>
        <to usec="0" sec="1436246065"/>
    </anomaly>
    <anomaly type="suspicious" value="1.593450,1.615520,999,1 1 1 1 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="38.143.241.139" src_port="38989" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1436245202"/>
        <to usec="0" sec="1436246100"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="14.14.104.45" dst_port="8080"/>
            <filter src_ip="14.14.104.45" dst_port="80"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245309"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="175.251.236.101" dst_ip="135.111.178.194" src_port="80" dst_port="64606"/>
            <filter src_ip="175.251.236.101" dst_ip="135.111.178.194" src_port="80" dst_port="64605"/>
            <filter src_ip="175.251.236.101" dst_ip="135.111.178.194" src_port="80" dst_port="64453"/>
            <filter src_ip="175.251.236.101" dst_ip="135.111.178.194" src_port="80" dst_port="64450"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="206.17.39.135" dst_ip="165.214.176.249" src_port="8035" dst_port="54422"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="165.214.158.42" src_port="25310"/>
        </slice>
        <from usec="0" sec="1436245202"/>
        <to usec="0" sec="1436245309"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="151.95.66.140" dst_ip="29.96.99.163" src_port="46313" dst_port="443"/>
            <filter src_ip="151.95.66.140" dst_ip="29.96.99.163" src_port="43120" dst_port="443"/>
            <filter src_ip="151.95.66.140" dst_ip="29.96.99.163" src_port="42698" dst_port="443"/>
        </slice>
        <from usec="0" sec="1436245211"/>
        <to usec="0" sec="1436245304"/>
    </anomaly>
    <anomaly type="suspicious" value="1.271410,1.483970,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436246029"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="86.222.123.133" dst_port="445"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245483"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="123.40.147.78" src_port="80"/>
        </slice>
        <from usec="0" sec="1436245206"/>
        <to usec="0" sec="1436245472"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="17.164.113.172" dst_ip="159.78.149.30" src_port="443" dst_port="52702"/>
            <filter src_ip="17.164.113.172" dst_ip="159.78.149.30" src_port="443" dst_port="52699"/>
            <filter src_ip="17.164.113.172" dst_ip="159.78.149.30" src_port="443" dst_port="52678"/>
            <filter src_ip="17.164.113.172" dst_ip="159.78.149.30" src_port="443" dst_port="52635"/>
            <filter src_ip="17.164.113.172" dst_ip="159.78.149.30" src_port="443" dst_port="52588"/>
        </slice>
        <from usec="0" sec="1436245208"/>
        <to usec="0" sec="1436245471"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="212.64.32.11" dst_ip="135.111.236.145" src_port="80"/>
            <filter src_ip="212.64.32.11" dst_ip="151.95.102.217" src_port="80"/>
        </slice>
        <from usec="0" sec="1436245313"/>
        <to usec="0" sec="1436245456"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="151.4.139.160" dst_ip="165.214.3.51" src_port="80"/>
        </slice>
        <from usec="0" sec="1436245367"/>
        <to usec="0" sec="1436245433"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="176.41.170.63" dst_ip="165.214.98.8" src_port="80"/>
            <filter src_ip="176.41.170.63" dst_ip="165.214.243.47" src_port="80"/>
        </slice>
        <from usec="0" sec="1436245417"/>
        <to usec="0" sec="1436245472"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.28.65.40" dst_ip="135.111.195.182" src_port="64722" dst_port="49958"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245579"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="215.117.200.40" dst_ip="165.214.0.247" src_port="80" dst_port="41346"/>
            <filter src_ip="215.117.200.40" dst_ip="165.214.0.247" src_port="80" dst_port="38696"/>
            <filter src_ip="215.117.200.40" dst_ip="165.214.0.247" src_port="80" dst_port="36627"/>
            <filter src_ip="215.117.200.40" dst_ip="195.15.197.162" src_port="443" dst_port="59909"/>
        </slice>
        <from usec="0" sec="1436245313"/>
        <to usec="0" sec="1436245412"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="72.168.31.184" dst_ip="194.180.57.33" src_port="7001" dst_port="41519"/>
            <filter src_ip="72.168.31.184" dst_ip="194.180.57.33" src_port="7001" dst_port="33635"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245636"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="68.4.77.107" src_port="80"/>
            <filter src_ip="68.4.77.107" src_port="443"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245651"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,503,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="128.138.44.154" dst_ip="173.185.111.66" dst_port="80"/>
        </slice>
        <from usec="0" sec="1436245648"/>
        <to usec="0" sec="1436245670"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="165.214.1.90" dst_ip="17.139.202.167" src_port="61780" dst_port="993"/>
            <filter src_ip="165.214.1.90" dst_ip="17.139.202.167" src_port="61779" dst_port="993"/>
            <filter src_ip="165.214.1.90" dst_ip="17.139.202.167" src_port="61778" dst_port="993"/>
            <filter src_ip="165.214.1.90" dst_ip="17.139.202.167" src_port="61777" dst_port="993"/>
            <filter src_ip="165.214.1.90" dst_ip="17.30.207.109" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1436245707"/>
        <to usec="0" sec="1436245754"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="105.249.129.181" src_port="34341"/>
        </slice>
        <from usec="0" sec="1436245216"/>
        <to usec="0" sec="1436245849"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="62.153.7.106" src_port="80"/>
            <filter src_ip="62.153.7.106" dst_ip="165.214.97.142" src_port="53"/>
        </slice>
        <from usec="0" sec="1436245217"/>
        <to usec="0" sec="1436245847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="98.167.133.225" dst_ip="195.15.196.178" src_port="1935" dst_port="57795"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245939"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="115.240.211.233" src_port="443"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245912"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,503,0 0 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="111.135.66.70" src_port="80"/>
        </slice>
        <from usec="0" sec="1436245202"/>
        <to usec="0" sec="1436245939"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="212.64.32.5" dst_ip="151.95.149.82" src_port="80"/>
        </slice>
        <from usec="0" sec="1436245846"/>
        <to usec="0" sec="1436245925"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332890,1.479950,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="61.22.85.226" dst_ip="203.235.166.116" src_port="443" dst_port="37913"/>
            <filter src_ip="61.22.85.226" dst_ip="203.235.166.116" src_port="443" dst_port="27625"/>
            <filter src_ip="61.22.85.226" dst_ip="203.235.166.116" src_port="443" dst_port="11097"/>
            <filter src_ip="61.22.85.226" dst_ip="203.235.166.116" src_port="443" dst_port="7284"/>
        </slice>
        <from usec="0" sec="1436245850"/>
        <to usec="0" sec="1436245968"/>
    </anomaly>
    <anomaly type="suspicious" value="1.271410,1.483970,503,0 0 0 0 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="128.138.196.145" dst_ip="62.212.13.169" dst_port="80"/>
            <filter src_ip="128.138.254.202" dst_ip="62.212.13.169" dst_port="80"/>
        </slice>
        <from usec="0" sec="1436245325"/>
        <to usec="0" sec="1436245998"/>
    </anomaly>
    <anomaly type="suspicious" value="1.313240,1.479420,999,0 0 0 1 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="194.180.57.18" dst_port="26123"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245967"/>
    </anomaly>
    <anomaly type="suspicious" value="1.172270,1.473790,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="218.196.82.95" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245472"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924899,1.307740,503,1 1 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="195.15.86.75" dst_ip="195.3.132.143"/>
            <filter src_ip="195.15.86.75" dst_port="80"/>
            <filter dst_ip="195.3.132.143" dst_port="80"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436246100"/>
    </anomaly>
    <anomaly type="suspicious" value="1.250790,1.483450,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="159.78.104.212" src_port="53"/>
            <filter dst_ip="159.78.104.212"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436246057"/>
    </anomaly>
    <anomaly type="suspicious" value="1.456370,1.506370,502,0 0 0 1 1 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="187.212.29.88" src_port="22"/>
        </slice>
        <from usec="0" sec="1436245207"/>
        <to usec="0" sec="1436245661"/>
    </anomaly>
    <anomaly type="suspicious" value="1.172270,1.473790,020,1 1 1 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="125.206.232.163"/>
        </slice>
        <from usec="0" sec="1436245916"/>
        <to usec="0" sec="1436245967"/>
    </anomaly>
    <anomaly type="suspicious" value="1.441070,1.486330,504,1 0 0 1 1 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="175.225.191.206" src_port="443"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245967"/>
    </anomaly>
    <anomaly type="suspicious" value="1.250790,1.483450,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="159.78.31.119" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.250790,1.483450,503,0 0 0 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="177.191.112.18" dst_ip="135.111.130.178"/>
            <filter src_ip="177.191.112.18" src_port="80"/>
            <filter src_ip="177.191.112.23" dst_ip="135.111.130.178"/>
            <filter src_ip="177.191.112.23" src_port="80"/>
            <filter dst_ip="135.111.130.178" src_port="80"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.250790,1.483450,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="216.116.8.251" dst_ip="159.78.113.135" src_port="80"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.250790,1.483450,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="159.78.29.43" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.250790,1.483450,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="159.78.58.170" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.250790,1.483450,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="159.78.249.128" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.250790,1.483450,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="194.180.45.25" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.250790,1.483450,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="135.111.149.28" src_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.250790,1.483450,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="159.78.104.64" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.250790,1.483450,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="201.255.43.95"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.250790,1.483450,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="159.78.199.204" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.250790,1.483450,503,0 0 0 0 0 0 1 1 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="107.131.98.113" dst_ip="135.111.21.209" src_port="80"/>
            <filter src_ip="107.131.98.121" dst_ip="135.111.21.209" src_port="80"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.250790,1.483450,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="159.78.104.44" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.250790,1.483450,011,0 0 0 0 0 0 1 1 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="64.139.160.144" src_port="3128" dst_port="12200"/>
            <filter dst_ip="64.139.160.144" src_port="8080" dst_port="12200"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.250790,1.483450,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="159.78.106.168" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.646450,1.662800,503,0 0 0 1 0 0 0 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="210.30.9.124"/>
            <filter dst_ip="151.95.28.244" src_port="80"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245771"/>
    </anomaly>
    <anomaly type="suspicious" value="1.583150,1.648290,503,1 0 0 0 0 0 0 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="194.180.45.225" dst_port="80"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245754"/>
    </anomaly>
    <anomaly type="suspicious" value="1.174830,1.378920,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="128.138.115.114"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.174830,1.378920,503,0 0 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="165.214.65.38"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.174830,1.378920,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="172.12.167.226"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.231200,1.368450,999,1 1 0 0 0 0 0 0 0 1 0 0,ipv4gretun">
        <slice>
            <filter src_ip="194.180.45.116" dst_ip="199.185.120.124"/>
            <filter src_ip="194.180.45.116" dst_ip="197.87.229.97"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155820,1.357000,999,1 0 0 0 0 0 0 0 0 1 0 0,point_to_point">
        <slice>
            <filter src_ip="194.180.43.236" dst_ip="121.180.243.89" src_port="60580"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.241110,1.374580,020,0 0 0 1 0 0 0 0 0 1 0 0,ptpDoSIC">
        <slice>
            <filter src_ip="194.54.190.153" dst_ip="194.180.44.231"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.174830,1.378920,999,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="215.1.216.167"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155820,1.357000,503,1 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="11.213.139.50" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.174830,1.378920,504,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="135.111.255.245" src_port="443"/>
            <filter src_ip="132.102.109.231" dst_ip="135.111.255.245" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.296280,1.385770,503,1 0 0 0 0 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="159.78.26.222" src_port="80"/>
            <filter dst_ip="159.78.26.222" dst_port="9019"/>
            <filter dst_ip="159.78.26.222" dst_port="9606"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.223120,1.352600,503,1 0 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.95.102.206" src_port="80"/>
            <filter dst_ip="151.95.102.206" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.174830,1.378920,504,0 0 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="62.200.211.57" src_port="443"/>
            <filter dst_ip="165.214.1.231" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155820,1.357000,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="86.220.30.56" dst_ip="165.214.176.179" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155820,1.357000,999,1 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="207.164.219.190" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.223120,1.352600,503,1 0 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="195.2.162.66" src_port="80"/>
            <filter dst_ip="195.2.162.66" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.174830,1.378920,020,0 0 0 0 0 0 0 0 0 1 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="218.190.94.165"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.223120,1.352600,504,1 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="29.96.98.132" dst_port="443"/>
            <filter dst_ip="29.96.98.142" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.391420,2.545450,503,1 1 0 1 1 1 1 1 1 1 1 0,ntscACK">
        <slice>
            <filter src_ip="195.2.153.248"/>
            <filter src_ip="195.15.86.198" dst_port="443"/>
            <filter src_ip="195.15.86.198" dst_port="80"/>
            <filter src_ip="194.180.43.19" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.616990,1.520530,504,1 0 0 1 0 0 1 0 0 0 1 0,mptp">
        <slice>
            <filter dst_ip="29.96.101.243" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.482050,2.606370,504,1 1 0 1 1 0 1 1 1 1 1 1,ntscACK">
        <slice>
            <filter src_ip="128.138.73.110" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.853430,1.569250,504,1 0 0 1 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="195.15.220.24" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.970170,2.301210,504,1 1 0 1 1 1 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="29.96.101.248" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.893970,2.158170,504,1 1 1 1 1 0 1 1 1 1 1 0,mptp">
        <slice>
            <filter dst_ip="175.225.148.131" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.274670,2.502590,503,1 1 0 1 0 0 1 1 1 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="206.18.18.245" dst_ip="194.180.39.253" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.482050,2.606370,503,1 1 0 1 1 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="195.15.86.75" src_port="443"/>
            <filter dst_ip="195.15.86.75" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.075430,3.084590,503,1 1 1 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="159.78.108.114" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.092340,2.417910,504,1 1 0 1 1 1 1 1 1 1 0 0,ntscACK">
        <slice>
            <filter src_ip="128.138.116.53" dst_port="443"/>
            <filter src_ip="128.138.116.53" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.482050,2.606370,503,1 1 0 1 1 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="195.15.86.198" src_port="80"/>
            <filter dst_ip="195.15.86.198" src_port="443"/>
            <filter dst_ip="195.2.153.248" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.970170,2.301210,010,1 1 0 1 1 1 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="64.139.162.13" src_port="12200" dst_port="21320"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.807770,2.256360,504,1 1 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="128.138.82.166" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.836140,2.253710,504,1 1 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="206.136.235.105" src_port="443"/>
            <filter dst_ip="165.214.0.227" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.807770,2.256360,503,1 1 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="135.118.171.220" dst_ip="73.93.175.5" src_port="80"/>
            <filter src_ip="135.118.171.220" dst_ip="207.205.253.227" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.642950,1.545830,010,1 1 1 1 0 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="88.67.143.69" src_port="6000" dst_port="8118"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.610310,2.034550,020,1 1 1 0 0 0 1 1 1 1 1 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="101.233.232.219"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.849750,1.571570,503,1 1 0 1 1 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="194.180.45.225" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.386470,1.863850,011,1 1 1 1 1 0 0 0 0 1 1 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="88.67.143.69" src_port="8118" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.740900,1.681360,020,1 1 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="125.204.253.70"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.740900,1.681360,020,1 1 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="49.177.75.196"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="2.640800,2.031620,503,1 1 1 1 0 0 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="195.235.239.215" src_port="80"/>
            <filter dst_ip="195.235.239.215" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.967160,1.806930,502,1 1 1 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="216.242.176.135" dst_ip="159.78.72.48"/>
            <filter src_ip="216.242.176.135" dst_port="22"/>
            <filter dst_ip="159.78.72.48" dst_port="22"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245954"/>
    </anomaly>
    <anomaly type="anomalous" value="3.615310,2.801750,503,1 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="111.135.66.82" dst_ip="165.214.177.203" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.849750,1.571570,503,1 1 0 1 1 0 1 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="195.2.181.174" dst_port="53"/>
            <filter src_ip="195.2.181.174" dst_ip="125.43.39.181" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.786290,1.677810,999,1 1 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="194.180.57.92" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436246012"/>
    </anomaly>
    <anomaly type="anomalous" value="2.866640,2.363390,503,1 0 0 1 1 1 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="194.180.43.19" dst_port="80"/>
            <filter dst_ip="194.180.43.19"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436246067"/>
    </anomaly>
    <anomaly type="anomalous" value="2.362660,2.112310,504,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="212.101.136.201" dst_ip="195.15.194.242" src_port="443"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245489"/>
    </anomaly>
    <anomaly type="anomalous" value="2.044740,1.982830,503,0 0 0 1 0 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="128.138.196.145" dst_ip="62.212.13.169" dst_port="80"/>
            <filter src_ip="128.138.254.202" dst_ip="62.212.13.169" dst_port="80"/>
        </slice>
        <from usec="0" sec="1436245325"/>
        <to usec="0" sec="1436245998"/>
    </anomaly>
    <anomaly type="anomalous" value="2.362660,2.112310,999,0 0 0 1 1 1 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="194.180.39.224" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436246029"/>
    </anomaly>
    <anomaly type="anomalous" value="2.328530,2.115130,999,0 0 0 0 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="74.60.29.232" dst_ip="135.99.232.54" src_port="3076" dst_port="3076"/>
            <filter src_ip="180.185.143.26" dst_ip="135.99.232.54" src_port="53106" dst_port="10000"/>
            <filter src_ip="38.143.241.139" dst_ip="135.99.232.54" src_port="38989" dst_port="5060"/>
            <filter src_ip="90.84.236.151" dst_ip="135.99.232.54" src_port="35519" dst_port="23"/>
        </slice>
        <from usec="0" sec="1436245202"/>
        <to usec="0" sec="1436246007"/>
    </anomaly>
    <anomaly type="anomalous" value="2.362660,2.112310,010,0 0 0 1 1 1 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="51.230.123.41" dst_port="443"/>
            <filter src_ip="51.230.123.41" dst_port="80"/>
            <filter src_ip="51.230.123.41" dst_port="23"/>
            <filter src_ip="51.230.123.41" dst_port="21"/>
        </slice>
        <from usec="0" sec="1436245208"/>
        <to usec="0" sec="1436246007"/>
    </anomaly>
    <anomaly type="anomalous" value="2.111020,1.836850,999,0 0 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436246029"/>
    </anomaly>
    <anomaly type="anomalous" value="1.926030,1.810230,020,1 1 1 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="116.115.38.159"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.747920,1.686360,999,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="73.69.213.168" dst_ip="159.78.104.212"/>
            <filter src_ip="73.69.213.168" src_port="53"/>
            <filter dst_ip="159.78.104.212" src_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436246029"/>
    </anomaly>
    <anomaly type="anomalous" value="2.472860,1.909530,503,1 0 0 1 0 0 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="135.111.136.18" src_port="80"/>
            <filter dst_ip="135.111.136.18" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.043490,1.735880,503,1 0 0 1 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter dst_ip="159.78.148.102" src_port="80"/>
            <filter dst_ip="159.78.108.152" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.735190,1.668480,504,1 0 0 1 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="135.111.60.76" dst_ip="105.190.92.66" dst_port="443"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245967"/>
    </anomaly>
    <anomaly type="anomalous" value="1.809720,1.573050,504,1 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="62.223.220.206" dst_ip="165.214.142.0" src_port="443"/>
            <filter src_ip="62.223.220.206" dst_ip="165.214.142.43" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.688430,1.672060,999,1 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="195.15.219.108" dst_ip="216.240.222.45" dst_port="53"/>
            <filter src_ip="195.15.222.245" dst_ip="216.240.222.45" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245967"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="195.15.222.245" dst_ip="80.156.169.170" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245967"/>
    </anomaly>
    <anomaly type="anomalous" value="2.353260,2.098060,504,1 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="195.15.86.198" dst_ip="17.157.187.207" dst_port="443"/>
        </slice>
        <from usec="0" sec="1436245202"/>
        <to usec="0" sec="1436246020"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="48.210.40.33"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436246057"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="165.214.12.32" dst_port="34861"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245967"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="48.206.144.130"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245967"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="48.206.144.131"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245967"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="165.214.227.6" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245967"/>
    </anomaly>
    <anomaly type="anomalous" value="1.747920,1.686360,020,0 0 0 1 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="194.180.45.155"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245967"/>
    </anomaly>
    <anomaly type="anomalous" value="1.955490,1.612890,503,0 0 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="195.71.178.16" src_port="80"/>
            <filter src_ip="195.71.178.16" src_port="443"/>
            <filter dst_ip="165.214.167.172" src_port="80"/>
            <filter dst_ip="165.214.2.34" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.353260,2.098060,503,1 0 0 1 1 1 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="165.214.1.190" dst_port="80"/>
        </slice>
        <from usec="0" sec="1436245206"/>
        <to usec="0" sec="1436246029"/>
    </anomaly>
    <anomaly type="anomalous" value="1.747920,1.686360,999,0 0 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="159.78.104.212" src_port="53"/>
            <filter dst_ip="159.78.104.212"/>
            <filter dst_ip="159.78.104.212"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436246012"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,503,0 0 0 0 0 0 1 1 1 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="177.191.112.23" dst_ip="135.111.130.181" src_port="80"/>
            <filter src_ip="177.191.112.18" dst_ip="135.111.130.181" src_port="80"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="195.15.219.106" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,503,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="194.180.38.145" dst_ip="190.91.92.0"/>
            <filter src_ip="194.180.38.145" dst_port="80"/>
            <filter src_ip="194.180.38.144" dst_ip="190.91.92.0"/>
            <filter dst_ip="190.91.92.0" dst_port="80"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="195.15.222.245" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.747920,1.686360,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="135.111.214.58" src_port="53"/>
            <filter dst_ip="135.111.139.103" src_port="53"/>
            <filter src_ip="62.244.66.42" dst_ip="135.111.13.79" src_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245489"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="125.228.249.1"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="194.180.44.243" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="195.15.207.215" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="194.180.44.238" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.747920,1.686360,504,0 0 0 1 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="62.200.209.238" dst_ip="135.111.137.113" src_port="443"/>
            <filter src_ip="62.147.112.133" dst_ip="135.111.137.113" src_port="443"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245318"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="194.180.44.235" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="186.49.65.153"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="159.78.54.145" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="124.221.10.9"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="194.180.45.44" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="206.35.251.47" dst_ip="151.95.160.34" src_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="135.118.3.197" dst_ip="175.226.158.93" src_port="5900"/>
            <filter src_ip="128.138.248.65" dst_ip="175.226.158.93" src_port="5900"/>
            <filter src_ip="128.138.131.207" dst_ip="175.226.158.93" src_port="5900"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="99.187.228.213"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="165.214.73.124"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245967"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="195.15.218.125" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="194.180.42.59" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="2.014960,1.756470,503,0 0 0 0 0 0 1 1 1 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="17.212.124.6" dst_ip="194.180.43.234" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="195.15.87.54" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.95.28.253" src_port="80"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="2.014960,1.756470,999,0 0 0 0 0 0 1 1 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="195.15.87.63" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="195.2.173.69" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="195.2.173.73" dst_ip="80.156.169.171" dst_port="53"/>
            <filter src_ip="195.15.222.245" dst_ip="80.156.169.171" dst_port="53"/>
            <filter src_ip="195.15.219.108" dst_ip="80.156.169.171" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245967"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="195.15.222.245" dst_ip="216.240.222.44" dst_port="53"/>
            <filter src_ip="195.15.219.108" dst_ip="216.240.222.44" dst_port="53"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245967"/>
    </anomaly>
    <anomaly type="anomalous" value="1.701500,1.689890,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="194.180.40.202"/>
        </slice>
        <from usec="0" sec="1436245201"/>
        <to usec="0" sec="1436245967"/>
    </anomaly>
    <anomaly type="anomalous" value="1.421400,1.392710,504,1 1 0 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="194.180.37.94" dst_port="443"/>
            <filter src_ip="195.15.86.198" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.947250,2.307450,504,0 0 0 1 1 1 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="111.135.66.189" src_port="80"/>
            <filter src_ip="111.135.66.189" src_port="443"/>
            <filter dst_ip="159.78.149.29" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.858770,1.582940,503,1 1 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="194.180.45.225" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.621440,2.812430,999,0 0 0 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="194.180.32.53" dst_ip="44.115.235.98"/>
            <filter src_ip="194.180.32.53" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.858770,1.582940,504,1 1 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="111.135.66.189" src_port="80"/>
            <filter src_ip="111.135.66.189" src_port="443"/>
            <filter dst_ip="159.78.150.237" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.732200,2.886340,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="187.212.29.89" src_port="5532" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.033200,1.719200,503,1 1 1 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="165.214.1.96" src_port="80"/>
            <filter dst_ip="165.214.1.96" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.073250,2.368420,504,1 1 0 1 1 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="111.135.66.178" src_port="443"/>
            <filter src_ip="188.42.255.83" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.812120,2.260080,503,0 0 0 1 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="178.6.67.211" dst_ip="165.214.2.78" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.621440,2.812430,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="17.212.124.2" dst_ip="165.214.225.153"/>
            <filter src_ip="17.212.124.2" src_port="80"/>
            <filter dst_ip="165.214.225.153" src_port="80"/>
            <filter src_ip="17.212.124.1" dst_ip="195.15.86.198" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.623490,2.159290,503,1 1 0 1 1 1 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="128.138.248.20" dst_ip="207.164.224.79"/>
            <filter src_ip="128.138.248.20" dst_ip="164.4.48.21"/>
            <filter src_ip="194.180.40.80" dst_ip="207.164.224.79"/>
            <filter src_ip="194.180.40.80" dst_ip="164.4.48.21"/>
            <filter dst_ip="207.164.224.79" src_port="123"/>
            <filter dst_ip="207.164.224.79"/>
            <filter dst_ip="207.164.224.79" dst_port="80"/>
            <filter dst_ip="207.164.224.79"/>
            <filter dst_ip="164.4.48.21" src_port="123"/>
            <filter dst_ip="164.4.48.21"/>
            <filter dst_ip="164.4.48.21" dst_port="80"/>
            <filter dst_ip="164.4.48.21"/>
            <filter src_ip="128.138.248.20" src_port="123" dst_port="80"/>
            <filter src_ip="194.180.40.80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.821920,1.592000,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="195.15.220.24" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.082330,2.396980,010,1 1 1 1 1 1 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="120.67.62.110" src_port="31299" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.821920,1.592000,999,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="194.180.32.9" dst_port="8080"/>
            <filter dst_ip="194.180.32.9"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.809720,1.573050,999,1 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="121.180.243.89" dst_ip="194.180.43.236" dst_port="60580"/>
            <filter src_ip="74.192.182.160" dst_ip="194.180.43.236" dst_port="60580"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.778060,2.899980,999,1 1 1 1 1 1 1 0 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="163.208.2.192" src_port="43157" dst_port="5093"/>
            <filter src_ip="163.208.2.192" src_port="55190" dst_port="5093"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.821920,1.592000,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="48.61.136.207" dst_ip="159.78.70.50" src_port="65494" dst_port="45615"/>
            <filter src_ip="48.61.136.207" dst_ip="159.78.70.50" src_port="65494" dst_port="28226"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.783510,2.262720,999,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="44.115.235.98" dst_ip="194.180.32.53"/>
            <filter dst_ip="194.180.32.53" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.011140,2.368130,010,1 1 1 1 0 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="101.233.232.219" src_port="59630" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.872710,2.277470,503,0 0 0 1 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="151.95.28.245" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.955490,1.612890,503,0 0 0 1 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.95.28.252" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.821920,1.592000,999,0 0 0 0 0 0 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="194.180.32.6" dst_ip="215.1.216.167" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.809720,1.573050,504,1 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="135.111.79.104" dst_ip="96.82.225.32" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.668680,2.826420,503,0 0 0 1 1 1 1 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="111.135.66.178" src_port="443"/>
            <filter src_ip="98.167.135.122" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
