<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.706320,1.735860,999,1 1 1 0 0 0 0 0 0 1 1 0,ipv46tun">
        <slice>
            <filter src_ip="220.249.17.132" dst_ip="29.142.61.159" src_port="8080" dst_port="12200"/>
            <filter src_ip="220.249.17.132" dst_ip="8.212.144.173"/>
            <filter src_ip="220.249.17.132" dst_ip="221.140.104.12"/>
            <filter src_ip="220.249.17.132" dst_ip="163.125.38.119"/>
            <filter src_ip="220.249.17.132" dst_ip="15.241.168.92"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.514240,1.666680,503,1 1 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.102.122.148" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.560040,1.675700,503,1 1 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="159.28.97.51" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.560040,1.675700,503,1 1 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="159.28.188.150" dst_ip="67.24.185.37" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.706320,1.735860,503,1 1 1 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="136.165.129.177" dst_ip="160.111.203.32" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.231500,1.680490,504,1 1 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="159.28.93.242" dst_ip="203.118.251.55" src_port="49436" dst_port="443"/>
            <filter src_ip="159.28.93.242" dst_ip="203.118.251.55" src_port="49244" dst_port="443"/>
            <filter src_ip="159.28.93.242" dst_ip="29.174.213.68" src_port="49365" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010004"/>
        <to usec="0" sec="1439010759"/>
    </anomaly>
    <anomaly type="suspicious" value="1.706320,1.735860,503,1 1 1 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="176.134.66.6" dst_ip="219.192.157.218" src_port="80"/>
            <filter src_ip="176.134.66.6" dst_ip="219.192.157.173" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.514240,1.666680,503,1 1 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="160.111.201.215" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.092400,2.218850,010,1 1 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="89.122.108.249" dst_port="22"/>
        </slice>
        <from usec="0" sec="1439010162"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="suspicious" value="1.231500,1.680490,010,1 1 0 1 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="197.191.109.87" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010036"/>
        <to usec="0" sec="1439010063"/>
    </anomaly>
    <anomaly type="suspicious" value="1.337040,1.710390,999,1 1 1 0 0 0 1 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="220.249.13.208" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="221.6.155.190"/>
        </slice>
        <from usec="0" sec="1439010001"/>
        <to usec="0" sec="1439010199"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="159.28.193.99"/>
        </slice>
        <from usec="0" sec="1439010008"/>
        <to usec="0" sec="1439010281"/>
    </anomaly>
    <anomaly type="suspicious" value="1.185270,1.677500,010,1 0 0 1 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.5.114.123" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010191"/>
        <to usec="0" sec="1439010197"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="181.190.191.112"/>
        </slice>
        <from usec="0" sec="1439010004"/>
        <to usec="0" sec="1439010376"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="220.249.18.169"/>
        </slice>
        <from usec="0" sec="1439010001"/>
        <to usec="0" sec="1439010469"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="207.97.53.124"/>
        </slice>
        <from usec="0" sec="1439010001"/>
        <to usec="0" sec="1439010468"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="55.106.208.59"/>
        </slice>
        <from usec="0" sec="1439010020"/>
        <to usec="0" sec="1439010345"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="66.97.37.222"/>
        </slice>
        <from usec="0" sec="1439010030"/>
        <to usec="0" sec="1439010464"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,504,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="155.194.121.82"/>
        </slice>
        <from usec="0" sec="1439010262"/>
        <to usec="0" sec="1439010463"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,504,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="147.206.156.109"/>
        </slice>
        <from usec="0" sec="1439010315"/>
        <to usec="0" sec="1439010347"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="125.77.250.221"/>
        </slice>
        <from usec="0" sec="1439010349"/>
        <to usec="0" sec="1439010352"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="206.254.188.142"/>
        </slice>
        <from usec="0" sec="1439010358"/>
        <to usec="0" sec="1439010380"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="219.19.121.53"/>
        </slice>
        <from usec="0" sec="1439010360"/>
        <to usec="0" sec="1439010361"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="219.32.219.224"/>
        </slice>
        <from usec="0" sec="1439010443"/>
        <to usec="0" sec="1439010445"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="181.190.62.38"/>
        </slice>
        <from usec="0" sec="1439010010"/>
        <to usec="0" sec="1439010647"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="221.15.234.191"/>
        </slice>
        <from usec="0" sec="1439010016"/>
        <to usec="0" sec="1439010649"/>
    </anomaly>
    <anomaly type="suspicious" value="1.231500,1.680490,504,1 1 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="169.102.180.134" dst_ip="106.225.203.233"/>
            <filter src_ip="169.102.180.134" dst_port="443"/>
            <filter src_ip="169.102.249.151" dst_ip="106.225.203.233" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010001"/>
        <to usec="0" sec="1439010645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="209.47.42.199"/>
        </slice>
        <from usec="0" sec="1439010199"/>
        <to usec="0" sec="1439010592"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="91.95.224.223"/>
        </slice>
        <from usec="0" sec="1439010367"/>
        <to usec="0" sec="1439010643"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289170,1.713400,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="17.71.96.215"/>
        </slice>
        <from usec="0" sec="1439010414"/>
        <to usec="0" sec="1439010489"/>
    </anomaly>
    <anomaly type="suspicious" value="1.345410,1.706770,504,1 1 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010001"/>
        <to usec="0" sec="1439010894"/>
    </anomaly>
    <anomaly type="suspicious" value="1.144510,1.649300,504,1 1 0 0 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="106.225.221.141" src_port="443"/>
            <filter src_ip="106.225.221.131" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.337040,1.710390,503,1 1 1 0 0 0 1 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="220.249.16.42" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.126850,2.243880,020,0 0 0 0 0 0 1 1 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="160.34.229.31"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="suspicious" value="2.126850,2.243880,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="43.156.167.85" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="suspicious" value="2.126850,2.243880,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="194.84.110.222" dst_port="8081"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="suspicious" value="2.065530,2.216590,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.95.48.37" dst_port="161"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="suspicious" value="2.126850,2.243880,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="133.95.48.42" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="suspicious" value="2.126850,2.243880,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.49.61.120" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="suspicious" value="2.126850,2.243880,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="133.95.48.8" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="suspicious" value="2.126850,2.243880,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="29.142.61.159" src_port="12200" dst_port="21320"/>
            <filter src_ip="29.142.61.159" src_port="12200" dst_port="8118"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="suspicious" value="2.126850,2.243880,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="133.95.105.232" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="suspicious" value="1.523810,1.672700,503,1 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="220.249.25.137" dst_ip="214.17.188.157" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.206340,1.682820,010,0 0 0 0 0 0 1 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="39.207.169.7" src_port="34680"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.523810,1.672700,503,1 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="210.214.138.158" dst_ip="169.102.50.36" src_port="80" dst_port="35974"/>
            <filter src_ip="210.214.138.158" dst_ip="169.102.50.36" src_port="80" dst_port="20049"/>
            <filter src_ip="210.214.138.158" dst_ip="169.102.50.36" src_port="80" dst_port="13602"/>
            <filter src_ip="128.130.103.98" dst_ip="169.102.50.36" src_port="80" dst_port="45260"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.560040,1.675700,503,1 1 0 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="159.28.96.156" dst_port="80"/>
            <filter src_ip="159.28.96.156" dst_port="443"/>
            <filter src_ip="159.28.96.66" dst_ip="214.160.53.248"/>
            <filter src_ip="159.28.96.66" dst_port="80"/>
            <filter src_ip="181.190.62.109" dst_ip="214.160.53.248" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.605950,1.708700,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="159.28.96.149" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.561500,1.699860,999,0 0 0 1 0 0 0 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="220.249.17.160" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.144510,1.649300,010,1 1 0 0 0 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="89.122.108.225" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.605950,1.708700,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="159.28.96.151" src_port="80"/>
            <filter src_ip="33.120.96.165" dst_ip="159.28.98.208" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.605950,1.708700,502,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="220.249.27.194" dst_ip="161.234.126.207" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.605950,1.708700,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="125.104.83.62" dst_ip="169.102.241.229" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.605950,1.708700,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="37.232.137.51" dst_ip="169.102.180.100" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.605950,1.708700,999,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="220.249.31.50" dst_ip="95.112.177.226" src_port="8080" dst_port="22961"/>
            <filter src_ip="220.249.31.50" dst_ip="95.112.177.226" src_port="6881" dst_port="22962"/>
            <filter src_ip="220.249.31.59" dst_ip="95.112.177.226"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.605950,1.708700,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="159.28.80.42" dst_ip="66.97.106.197" src_port="60142" dst_port="8333"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.063290,3.296050,010,1 1 1 1 0 0 1 1 1 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="198.51.217.150" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.648210,2.522200,011,1 1 1 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="89.122.108.249" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.926210,1.718900,503,1 1 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="220.249.31.14" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.332640,1.983770,010,1 1 1 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="3.65.98.200" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.062770,3.750410,999,1 1 1 1 1 1 1 1 1 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="26.2.30.21" src_port="53390" dst_port="1434"/>
            <filter src_ip="178.33.18.190" src_port="41593" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.232230,2.312100,503,0 0 0 1 1 1 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="77.11.108.171" dst_ip="169.102.233.33" src_port="80" dst_port="49899"/>
            <filter src_ip="77.11.108.242" dst_ip="169.102.233.33" src_port="80" dst_port="49989"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.327650,2.351250,503,1 1 1 1 1 1 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="220.249.16.42" dst_port="80"/>
            <filter src_ip="214.17.188.157" dst_ip="220.249.25.137" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.896980,1.715980,503,1 0 0 1 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="169.102.4.245" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.688220,2.539790,503,1 1 1 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="160.111.132.234" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.566500,2.479150,999,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="220.249.31.10"/>
            <filter dst_ip="44.9.104.36" src_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.872910,2.283690,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.223.74.220" dst_ip="159.28.96.12" src_port="80" dst_port="58099"/>
            <filter src_ip="133.223.74.220" dst_ip="159.28.96.12" src_port="80" dst_port="57597"/>
            <filter src_ip="133.223.74.220" dst_ip="160.111.122.13" src_port="80" dst_port="61365"/>
            <filter src_ip="133.223.74.220" dst_ip="160.111.219.147" src_port="80" dst_port="36016"/>
            <filter src_ip="133.223.74.220" dst_ip="160.111.154.43" src_port="80" dst_port="55979"/>
        </slice>
        <from usec="0" sec="1439010003"/>
        <to usec="0" sec="1439010109"/>
    </anomaly>
    <anomaly type="anomalous" value="2.872910,2.283690,504,0 0 0 1 1 1 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="31.95.144.210" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010003"/>
        <to usec="0" sec="1439010199"/>
    </anomaly>
    <anomaly type="anomalous" value="2.872910,2.283690,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="33.27.214.197" dst_ip="169.102.122.204" src_port="80" dst_port="35229"/>
            <filter src_ip="33.27.214.197" dst_ip="169.102.122.204" src_port="80" dst_port="33531"/>
        </slice>
        <from usec="0" sec="1439010190"/>
        <to usec="0" sec="1439010288"/>
    </anomaly>
    <anomaly type="anomalous" value="3.582130,2.481180,999,1 1 0 1 1 1 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="220.249.31.17" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.164960,1.972850,020,0 0 0 1 1 0 0 0 0 0 0 0,sptpDoSIC">
        <slice>
            <filter src_ip="69.223.108.97" dst_ip="220.249.23.103"/>
        </slice>
        <from usec="0" sec="1439010004"/>
        <to usec="0" sec="1439010363"/>
    </anomaly>
    <anomaly type="anomalous" value="2.164960,1.972850,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="159.28.147.93" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010009"/>
        <to usec="0" sec="1439010469"/>
    </anomaly>
    <anomaly type="anomalous" value="2.164960,1.972850,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="215.57.135.64" dst_ip="169.102.122.198" src_port="80" dst_port="49313"/>
            <filter src_ip="215.57.135.64" dst_ip="169.102.122.198" src_port="80" dst_port="43323"/>
            <filter src_ip="215.57.135.64" dst_ip="169.102.122.198" src_port="80" dst_port="40275"/>
        </slice>
        <from usec="0" sec="1439010153"/>
        <to usec="0" sec="1439010365"/>
    </anomaly>
    <anomaly type="anomalous" value="3.602360,2.503590,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="160.111.52.186" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.602360,2.503590,999,0 0 0 1 1 1 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="220.249.31.10" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.602360,2.503590,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="159.28.146.149" src_port="80"/>
            <filter dst_ip="159.28.146.149" src_port="443"/>
            <filter src_ip="33.120.96.85" dst_ip="159.28.98.208" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.648210,2.522200,504,1 1 1 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="221.15.233.51" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.656680,3.600920,010,1 1 1 1 1 1 1 1 1 1 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="7.48.111.250" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.237860,2.305010,503,1 0 0 1 1 1 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="138.127.3.211" src_port="80"/>
            <filter src_ip="138.127.3.213" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.582130,2.481180,010,1 1 0 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="44.9.104.36" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.688220,2.539790,010,1 1 1 1 1 1 1 0 0 1 1 1,DDoSSYN">
        <slice>
            <filter dst_ip="8.177.22.33" dst_port="118"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.725710,2.698950,502,1 1 1 1 1 0 1 1 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="221.185.118.177" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.564780,3.239310,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="160.34.228.114" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="anomalous" value="3.564780,3.239310,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="158.147.156.44" src_port="44733" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="anomalous" value="3.564780,3.239310,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="209.205.8.99" src_port="80"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="anomalous" value="3.564780,3.239310,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="89.122.108.226"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="anomalous" value="3.564780,3.239310,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="160.34.229.31" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="anomalous" value="2.526920,1.997110,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="221.234.156.236" src_port="80"/>
            <filter dst_ip="221.234.156.236" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.327650,2.351250,502,1 1 1 1 1 1 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="221.185.118.177" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.963570,1.751090,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="175.41.130.175" dst_ip="159.28.97.232" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.566500,2.479150,999,1 0 0 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="220.249.31.17" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.841940,3.254780,503,0 0 0 1 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter dst_ip="169.102.122.149" src_port="80"/>
            <filter dst_ip="169.102.122.154" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.566500,2.479150,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="169.102.122.155" src_port="80"/>
            <filter dst_ip="169.102.122.207" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.260260,1.960050,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="169.102.237.68" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.260260,1.960050,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="159.28.97.137" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.260260,1.960050,999,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="159.28.98.185" dst_port="55543"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.260260,1.960050,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="159.28.23.90" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.202650,1.928740,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="159.28.188.155" src_port="80"/>
            <filter dst_ip="159.28.188.155" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.227870,1.931350,504,1 1 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="221.15.233.51" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.534120,1.988900,503,1 0 0 1 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="221.6.165.209" src_port="53"/>
            <filter dst_ip="221.6.165.209" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.602360,2.503590,999,0 0 0 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="220.249.31.57" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.260260,1.960050,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="46.254.211.222" dst_ip="159.28.98.246" src_port="80"/>
            <filter src_ip="46.254.211.222" dst_ip="160.111.200.209" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.260260,1.960050,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="169.102.26.103"/>
            <filter dst_ip="169.102.50.111" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.260260,1.960050,999,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="176.149.29.99" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.260260,1.960050,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="160.111.11.254" src_port="80"/>
            <filter dst_ip="160.111.11.254" dst_port="8090"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.062770,3.750410,010,1 1 1 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="89.122.108.226" dst_port="22"/>
            <filter src_ip="132.74.59.104" src_port="43366" dst_port="19"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.036940,1.776330,999,0 0 0 1 0 0 1 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="169.102.116.217" src_port="53"/>
            <filter dst_ip="220.249.21.251" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.260260,1.960050,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="169.102.231.215" src_port="80"/>
            <filter src_ip="75.163.27.224" dst_ip="169.102.231.215" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.202650,1.928740,503,1 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="159.28.147.19" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.260260,1.960050,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="159.28.4.255" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
