<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.437170,1.838390,503,1 1 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="153.23.230.142" dst_port="80"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775575"/>
    </anomaly>
    <anomaly type="suspicious" value="1.474430,1.829320,999,1 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="153.23.245.216" dst_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.707600,1.861020,010,1 1 1 0 0 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="13.73.158.199" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.512350,1.821390,504,1 1 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="94.201.43.140" dst_ip="153.23.19.122" src_port="443" dst_port="54705"/>
            <filter src_ip="94.201.43.140" dst_ip="153.23.19.122" src_port="443" dst_port="54704"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.765470,1.829090,504,1 1 0 1 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="151.87.65.112" src_port="443"/>
            <filter dst_ip="151.87.65.112" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.701510,1.846020,504,1 1 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="104.122.196.135" dst_port="443"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.816450,1.889590,502,1 1 1 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="67.112.143.169" src_port="22"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775691"/>
    </anomaly>
    <anomaly type="suspicious" value="1.311040,1.787480,010,1 1 1 1 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="208.3.50.45" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1441774915"/>
        <to usec="0" sec="1441775688"/>
    </anomaly>
    <anomaly type="suspicious" value="1.222480,1.792180,010,1 1 1 1 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="197.129.172.94" dst_port="23"/>
        </slice>
        <from usec="0" sec="1441775210"/>
        <to usec="0" sec="1441775248"/>
    </anomaly>
    <anomaly type="suspicious" value="1.571560,1.882140,020,1 1 1 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="51.118.55.3"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="2.016270,2.118200,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775359"/>
    </anomaly>
    <anomaly type="suspicious" value="1.707600,1.861020,502,1 1 1 0 0 0 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="87.176.238.249" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.571560,1.882140,999,1 1 1 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="7.18.145.32" dst_ip="218.13.113.73" dst_port="53"/>
            <filter src_ip="7.18.145.32" dst_ip="218.13.117.7" dst_port="53"/>
            <filter src_ip="7.18.145.32" dst_ip="218.13.123.18" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775076"/>
    </anomaly>
    <anomaly type="suspicious" value="1.289910,1.823900,010,1 1 1 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="116.220.116.25" dst_port="23"/>
        </slice>
        <from usec="0" sec="1441775251"/>
        <to usec="0" sec="1441775700"/>
    </anomaly>
    <anomaly type="suspicious" value="1.571560,1.882140,010,1 1 1 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="137.186.135.57" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.716500,1.889560,999,0 0 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.23.69.120" dst_port="19029"/>
            <filter dst_ip="153.23.69.120" dst_port="11016"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775359"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.23.224.127" dst_port="21679"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="191.236.31.102" dst_ip="141.151.46.80" src_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="137.163.246.216"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.716500,1.889560,901,0 0 0 1 0 0 1 1 1 0 0 0,empty">
        <slice/>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775357"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,020,0 0 0 0 0 0 1 1 1 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="153.23.58.44"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,503,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="137.163.231.110" dst_ip="37.251.103.84" src_port="80"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="218.13.115.58" src_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="223.93.30.42"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.716500,1.889560,020,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="218.13.113.113" src_port="80"/>
            <filter dst_ip="218.13.113.113"/>
            <filter dst_ip="218.13.113.112"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775442"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.23.226.203" src_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="191.236.31.101" dst_ip="141.151.170.80" src_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="19.98.132.172" dst_ip="141.151.233.105" src_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.397210,1.846250,502,1 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="39.83.38.18" dst_port="22"/>
            <filter dst_ip="176.78.224.165" dst_port="22"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.112.145.166" dst_port="53"/>
            <filter src_ip="207.112.145.202" dst_ip="153.112.145.166" src_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="152.106.221.159"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="172.116.63.172"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.112.82.1" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.87.36.165" src_port="80"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.716500,1.889560,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="176.78.192.89" src_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775448"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.23.107.111" dst_port="54762"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="172.159.201.142"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.112.82.21" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="141.151.248.207"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.23.107.63" dst_port="54770"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="170.227.220.210"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="137.186.135.89" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="151.87.140.106" dst_port="63948"/>
            <filter src_ip="33.103.63.238" dst_ip="151.87.140.106" src_port="49673"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="214.157.178.237" dst_ip="151.87.216.63" src_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.667900,1.853850,999,1 0 0 1 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="153.23.168.211" src_port="80" dst_port="1900"/>
            <filter dst_ip="153.23.168.211" src_port="53" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775538"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="218.13.112.128" src_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.112.33.134" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,502,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter dst_ip="164.118.131.118" src_port="22"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.23.19.95" dst_port="54762"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,504,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="76.240.156.21" dst_ip="151.87.65.95" src_port="443"/>
            <filter src_ip="79.3.41.142" dst_ip="151.87.65.95" src_port="443"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.112.33.145" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.23.19.194" dst_port="54770"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="210.236.141.246" dst_ip="218.13.124.48" src_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="137.179.107.129" src_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.87.33.202" src_port="80"/>
            <filter dst_ip="151.87.33.202" src_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.87.33.201" src_port="80"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="137.179.174.52"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,504,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="10.252.50.238" dst_ip="176.78.249.219" src_port="80"/>
            <filter src_ip="137.55.159.60" dst_ip="176.78.249.219" src_port="443"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="49.176.92.18"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.397210,1.846250,999,1 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.23.130.77" src_port="13000" dst_port="1395"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775480"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.112.83.2" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.397210,1.846250,020,1 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="218.13.113.113"/>
            <filter src_ip="218.13.113.112"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775609"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="218.13.123.195"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.23.106.193" dst_port="54762"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.112.83.26" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="137.186.133.119" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="201.201.232.112"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.23.106.175" dst_port="54770"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,503,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="219.206.153.132" dst_ip="141.151.90.3" src_port="80"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="137.186.133.3" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="61.238.176.48"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="37.251.103.157"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.112.32.79" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="218.13.124.90"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="137.163.231.110" dst_ip="39.83.37.231" src_port="80"/>
            <filter src_ip="137.163.231.110" dst_ip="37.251.103.84" src_port="80"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775027"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,503,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="24.47.69.44" dst_ip="153.23.130.8" src_port="80"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.87.33.159" src_port="80"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.23.18.39" dst_port="54762"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.112.32.87" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.23.225.224" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="219.43.13.30" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.23.132.176" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="218.13.125.50" dst_port="80"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="219.34.111.155" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="219.34.111.157" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="219.43.55.34" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="218.13.123.36" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="219.34.120.111" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="218.13.123.63" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="218.13.123.59" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="218.13.123.56" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.23.196.158" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="218.13.112.178" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.23.178.156" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="218.13.122.10" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.23.162.105" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.23.134.195" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.701510,1.846020,999,1 1 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="218.13.99.19" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775700"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.23.187.131" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.23.116.108" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.23.75.120" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="219.34.110.145" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="218.13.122.43" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.23.225.63" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.23.225.62" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.23.225.55" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.23.80.173" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.397210,1.846250,999,1 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="219.43.13.22" dst_ip="177.112.5.58"/>
            <filter dst_ip="177.112.5.58" dst_port="53"/>
            <filter src_ip="219.43.13.22" dst_ip="187.80.74.160" dst_port="53"/>
            <filter src_ip="219.43.13.22" dst_ip="187.80.74.75" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775643"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="218.13.123.63" dst_port="53"/>
            <filter src_ip="219.34.111.157" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="218.13.127.176" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="204.18.42.0" dst_ip="218.13.117.179" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="218.13.124.117" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.23.225.103" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="153.23.226.7" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="219.34.184.221" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="219.34.184.208" dst_port="53"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454880,1.882110,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="153.23.19.26" dst_port="54770"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.529190,1.865510,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="116.229.158.255"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.707600,1.861020,010,1 1 1 0 0 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="69.61.155.160" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.474430,1.829320,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="7.63.194.239" dst_ip="219.34.185.28" src_port="80" dst_port="51789"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.529190,1.865510,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="215.71.147.74"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.529190,1.865510,502,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="219.34.191.56"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.779920,1.873030,020,0 0 0 1 0 0 0 0 0 1 0 0,icmp_error">
        <slice>
            <filter src_ip="218.13.124.117"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.529190,1.865510,999,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="104.165.94.132"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.529190,1.865510,503,0 0 0 0 0 0 0 0 0 1 0 0,point_to_point">
        <slice>
            <filter src_ip="68.115.251.245" dst_ip="176.78.48.151" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.529190,1.865510,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="62.58.62.246"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.529190,1.865510,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="49.13.90.127"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.529190,1.865510,504,0 0 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="221.179.50.204" dst_ip="141.151.189.15"/>
            <filter src_ip="221.179.50.204" src_port="443"/>
            <filter src_ip="221.179.50.204" src_port="80"/>
            <filter dst_ip="141.151.189.15" src_port="80"/>
            <filter src_ip="206.239.104.34" dst_ip="141.151.189.15" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.529190,1.865510,503,0 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="176.78.146.77" src_port="443"/>
            <filter src_ip="125.176.37.55" dst_ip="176.78.146.77" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.474430,1.829320,504,1 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="219.43.5.166" dst_ip="79.30.6.181" src_port="61216" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.391830,2.039790,503,1 1 0 0 0 0 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="176.78.144.6" dst_ip="32.208.157.31" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.339340,2.120890,010,1 1 1 1 1 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="31.249.31.61" src_port="12200" dst_port="1095"/>
            <filter src_ip="31.249.31.61" src_port="12200" dst_port="60088"/>
        </slice>
        <from usec="0" sec="1441775134"/>
        <to usec="0" sec="1441775311"/>
    </anomaly>
    <anomaly type="anomalous" value="4.772010,3.384120,503,1 1 0 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="218.13.122.163" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.697200,2.193490,504,1 1 1 1 1 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="59.195.207.184" dst_ip="137.179.46.220" src_port="443" dst_port="43312"/>
            <filter src_ip="59.195.207.184" dst_ip="137.179.46.220" src_port="443" dst_port="43310"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.748440,3.386600,504,1 1 0 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="170.209.34.92" dst_ip="153.23.116.163" src_port="443"/>
            <filter src_ip="170.209.34.92" dst_ip="153.23.116.175" src_port="443"/>
            <filter src_ip="170.209.34.92" dst_ip="153.23.116.173" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.785400,2.702230,503,1 1 0 1 0 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="218.13.112.166" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.975650,3.462730,011,1 1 1 1 1 1 1 1 1 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="1.77.228.251" src_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.299690,2.961060,010,1 1 1 1 1 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="26.0.59.241" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.637210,2.086060,011,1 1 1 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="36.80.82.201" dst_port="1"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.421640,2.407810,010,1 1 1 1 1 0 1 1 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="31.249.29.172" src_port="12200" dst_port="8080"/>
            <filter src_ip="31.249.29.172" src_port="12200" dst_port="21320"/>
            <filter src_ip="31.249.29.172" src_port="12200" dst_port="3128"/>
            <filter src_ip="31.249.29.172" src_port="12200" dst_port="8118"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.120480,2.979490,502,1 1 1 1 1 1 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="87.176.238.249" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.212470,2.124820,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="67.21.40.161" dst_port="445"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441774909"/>
    </anomaly>
    <anomaly type="anomalous" value="3.316670,2.757500,010,1 0 0 1 1 1 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="23.104.93.155" dst_port="23"/>
        </slice>
        <from usec="0" sec="1441774812"/>
        <to usec="0" sec="1441774997"/>
    </anomaly>
    <anomaly type="anomalous" value="3.341380,2.781630,502,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="218.13.115.90" dst_ip="66.103.206.33" src_port="22"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775089"/>
    </anomaly>
    <anomaly type="anomalous" value="3.341380,2.781630,999,0 0 0 1 1 1 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="151.87.129.12" src_port="53"/>
        </slice>
        <from usec="0" sec="1441774805"/>
        <to usec="0" sec="1441775088"/>
    </anomaly>
    <anomaly type="anomalous" value="3.341380,2.781630,503,0 0 0 1 1 1 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="62.58.62.202" dst_ip="137.163.151.120" src_port="80"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775127"/>
    </anomaly>
    <anomaly type="anomalous" value="2.212470,2.124820,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="217.114.237.233" dst_port="445"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775449"/>
    </anomaly>
    <anomaly type="anomalous" value="2.212470,2.124820,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="75.116.83.40" dst_ip="137.179.53.23" src_port="80" dst_port="34603"/>
            <filter src_ip="75.116.83.40" dst_ip="137.179.53.23" src_port="80" dst_port="34602"/>
            <filter src_ip="75.116.83.40" dst_ip="137.179.186.247" src_port="80" dst_port="34072"/>
            <filter src_ip="75.116.83.40" dst_ip="151.87.65.15" src_port="80" dst_port="34682"/>
        </slice>
        <from usec="0" sec="1441775070"/>
        <to usec="0" sec="1441775343"/>
    </anomaly>
    <anomaly type="anomalous" value="2.212470,2.124820,010,0 0 0 1 1 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="52.24.58.1" dst_port="23"/>
        </slice>
        <from usec="0" sec="1441775211"/>
        <to usec="0" sec="1441775246"/>
    </anomaly>
    <anomaly type="anomalous" value="2.565430,2.531070,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775359"/>
    </anomaly>
    <anomaly type="anomalous" value="4.333980,3.039080,503,1 1 1 1 1 1 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="153.23.229.163" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.785400,2.702230,503,1 1 0 1 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_port="80"/>
            <filter dst_ip="104.122.204.162" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.147610,2.976660,503,1 1 1 1 1 1 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="164.185.208.18" src_port="80"/>
            <filter src_ip="164.185.208.21" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.959710,2.170320,503,1 1 1 1 0 0 1 1 1 1 1 0,ntscACK">
        <slice>
            <filter src_ip="219.43.40.21" dst_port="443"/>
            <filter src_ip="219.43.40.21" dst_port="80"/>
            <filter src_ip="219.43.40.21" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.252410,2.933450,503,1 1 0 1 1 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="218.13.122.163" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.218540,1.924630,503,1 1 0 1 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter src_ip="79.2.110.48" src_port="443"/>
            <filter src_ip="223.211.224.159" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.736500,3.390880,999,1 0 0 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="218.13.127.12" dst_ip="40.113.39.173" src_port="123"/>
            <filter src_ip="218.13.127.12" dst_ip="75.23.50.189" src_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.838440,2.732180,503,1 1 1 1 0 0 1 1 1 1 1 1,ntscACK">
        <slice>
            <filter src_ip="102.148.7.201" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.578530,2.170450,504,1 1 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="104.122.194.113" dst_port="443"/>
            <filter dst_ip="59.214.119.28" dst_port="443"/>
        </slice>
        <from usec="0" sec="1441774801"/>
        <to usec="0" sec="1441775700"/>
    </anomaly>
    <anomaly type="anomalous" value="2.899440,2.170300,503,0 0 0 1 0 0 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.87.33.157" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.035540,1.959280,999,0 0 0 0 0 0 1 1 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="219.34.106.196" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.569390,2.086030,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="191.249.9.43" dst_ip="176.78.117.176" src_port="80" dst_port="57994"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.743330,2.125890,503,1 1 0 0 0 0 1 1 1 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="218.13.112.166" dst_ip="214.139.182.142" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.926140,2.244160,503,1 0 0 1 1 0 1 1 1 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="151.87.33.200" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.474910,2.079310,503,1 1 1 0 0 0 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="32.208.157.31" dst_ip="176.78.144.6" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.838440,2.732180,503,1 1 1 1 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="219.34.185.215" src_port="80"/>
            <filter dst_ip="219.34.185.28" dst_port="16177"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.299690,2.961060,503,1 1 1 1 1 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="153.23.229.38" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.402520,2.079280,999,0 0 0 0 0 0 0 0 0 1 1 0,ntscUDP">
        <slice>
            <filter src_ip="218.13.127.176" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.402520,2.079280,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="67.114.25.2" dst_ip="219.34.185.28" src_port="80" dst_port="39259"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.748440,3.386600,502,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="50.10.245.162" dst_port="22"/>
            <filter src_ip="55.108.251.32" dst_port="23"/>
            <filter dst_ip="137.186.26.36" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.975650,3.462730,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="15.237.60.193" src_port="59392" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.427220,2.660440,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="218.57.64.215" dst_ip="176.78.86.87" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.753830,3.410540,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="176.78.104.220" src_port="80"/>
            <filter dst_ip="176.78.104.220" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.736500,3.390880,999,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="218.13.118.166" src_port="3001"/>
            <filter src_ip="218.13.118.151" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.975650,3.462730,503,1 1 1 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="219.43.40.21" src_port="80"/>
            <filter dst_ip="219.43.40.21" src_port="53"/>
            <filter dst_ip="219.43.40.21" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.770410,2.707590,503,1 0 0 1 0 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="219.234.172.190" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.239980,3.003360,999,1 1 1 1 1 1 1 1 0 1 1 0,ntscUDP">
        <slice>
            <filter src_ip="165.163.114.139" dst_port="1701"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.728800,2.727030,010,1 1 1 0 0 0 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="40.224.19.154" dst_port="22"/>
            <filter src_ip="1.77.228.251" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
