<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.130460,1.371720,504,1 1 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="186.255.33.209" dst_port="443"/>
            <filter src_ip="186.255.33.209" dst_port="80"/>
            <filter src_ip="158.153.205.253" dst_port="443"/>
            <filter src_ip="158.153.205.253" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.109290,1.540490,503,1 1 1 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="161.56.71.170" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218898"/>
    </anomaly>
    <anomaly type="suspicious" value="1.364900,1.509550,011,1 1 1 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="126.41.220.33" src_port="1433"/>
            <filter dst_ip="86.15.247.87"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.076260,1.350020,504,1 0 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="161.97.29.195" dst_port="443"/>
            <filter dst_ip="104.89.237.65" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.216260,1.422030,503,1 0 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="221.91.154.132" dst_port="53"/>
            <filter src_ip="221.91.154.132" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218064"/>
        <to usec="0" sec="1447218892"/>
    </anomaly>
    <anomaly type="suspicious" value="1.416600,1.561250,503,1 1 0 1 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="221.80.65.14" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218013"/>
        <to usec="0" sec="1447218900"/>
    </anomaly>
    <anomaly type="suspicious" value="1.130460,1.371720,503,1 1 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="158.153.141.147" dst_port="80"/>
            <filter src_ip="158.153.141.147" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.416600,1.561250,504,1 1 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="4.56.100.183" dst_port="443"/>
            <filter dst_ip="68.18.210.32" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218898"/>
    </anomaly>
    <anomaly type="suspicious" value="1.364900,1.509550,999,1 1 1 0 0 0 0 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="211.92.228.74" src_port="5175" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.264470,1.442650,010,1 1 0 1 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="36.251.223.119" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218147"/>
        <to usec="0" sec="1447218172"/>
    </anomaly>
    <anomaly type="suspicious" value="1.109290,1.540490,999,1 1 1 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="221.80.172.254" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218853"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="68.52.234.114"/>
        </slice>
        <from usec="0" sec="1447218003"/>
        <to usec="0" sec="1447218106"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="158.153.61.106"/>
        </slice>
        <from usec="0" sec="1447218028"/>
        <to usec="0" sec="1447218108"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,503,0 0 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="158.153.214.100"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218198"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="142.182.43.208"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218286"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="94.226.83.173"/>
        </slice>
        <from usec="0" sec="1447218007"/>
        <to usec="0" sec="1447218270"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="221.80.173.22"/>
        </slice>
        <from usec="0" sec="1447218480"/>
        <to usec="0" sec="1447218537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.216260,1.422030,503,1 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="186.255.34.27" dst_ip="143.18.143.145" src_port="51613" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218879"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,999,0 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.56.15.162"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218727"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="127.241.248.45"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218737"/>
    </anomaly>
    <anomaly type="suspicious" value="1.216260,1.422030,999,1 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="86.246.30.87" src_port="3544"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218861"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,504,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="153.15.120.100"/>
        </slice>
        <from usec="0" sec="1447218002"/>
        <to usec="0" sec="1447218712"/>
    </anomaly>
    <anomaly type="suspicious" value="1.216260,1.422030,503,1 0 0 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="220.240.69.88" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218005"/>
        <to usec="0" sec="1447218895"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,504,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="32.59.100.175"/>
        </slice>
        <from usec="0" sec="1447218005"/>
        <to usec="0" sec="1447218736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,504,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="161.56.35.122"/>
        </slice>
        <from usec="0" sec="1447218021"/>
        <to usec="0" sec="1447218735"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="207.205.243.131"/>
        </slice>
        <from usec="0" sec="1447218042"/>
        <to usec="0" sec="1447218717"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="158.153.37.100"/>
        </slice>
        <from usec="0" sec="1447218046"/>
        <to usec="0" sec="1447218718"/>
    </anomaly>
    <anomaly type="suspicious" value="1.416600,1.561250,504,1 1 0 1 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="221.91.175.172" dst_port="443"/>
            <filter src_ip="221.91.175.172" dst_port="53"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218900"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,503,0 0 0 1 0 0 0 0 0 0 0 0,ntscACKt">
        <slice>
            <filter src_ip="186.255.169.131"/>
        </slice>
        <from usec="0" sec="1447218199"/>
        <to usec="0" sec="1447218638"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="51.200.34.74"/>
        </slice>
        <from usec="0" sec="1447218554"/>
        <to usec="0" sec="1447218564"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,020,0 0 0 1 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="119.247.79.118"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218798"/>
    </anomaly>
    <anomaly type="suspicious" value="1.326550,1.481850,503,0 0 0 1 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="13.137.82.158" dst_ip="186.255.146.24" src_port="80" dst_port="49383"/>
            <filter src_ip="13.137.82.158" dst_ip="186.255.146.24" src_port="80" dst_port="49382"/>
            <filter src_ip="154.88.175.202" dst_ip="186.255.146.24" src_port="80" dst_port="49379"/>
            <filter src_ip="154.88.175.216" dst_ip="186.255.146.24" src_port="80" dst_port="49380"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218558"/>
    </anomaly>
    <anomaly type="suspicious" value="1.054010,1.521200,010,1 0 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="42.218.80.81" src_port="12200" dst_port="60088"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218104"/>
    </anomaly>
    <anomaly type="suspicious" value="1.251470,1.476080,503,1 0 0 0 0 0 1 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="128.93.87.13" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.472270,1.597550,999,0 0 0 1 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.56.33.205" dst_port="24184"/>
        </slice>
        <from usec="0" sec="1447218293"/>
        <to usec="0" sec="1447218543"/>
    </anomaly>
    <anomaly type="suspicious" value="1.472270,1.597550,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="158.153.188.134" dst_port="53"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.109290,1.540490,999,1 1 1 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="221.80.173.35" dst_port="22148"/>
        </slice>
        <from usec="0" sec="1447218182"/>
        <to usec="0" sec="1447218747"/>
    </anomaly>
    <anomaly type="suspicious" value="1.506920,1.623270,020,1 1 1 0 0 0 1 0 0 1 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="211.92.228.74"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.251470,1.476080,503,1 0 0 0 0 0 1 0 0 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="220.240.70.219" dst_ip="211.21.167.249" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.506920,1.623270,010,1 1 1 0 0 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="104.112.126.76" src_port="12200" dst_port="8118"/>
            <filter src_ip="104.112.126.76" src_port="12200" dst_port="3128"/>
            <filter src_ip="104.112.126.76" src_port="12200" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="98.77.164.57"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,503,0 0 0 0 0 0 0 0 0 1 0 0,malphfl">
        <slice>
            <filter src_ip="81.60.33.143" dst_ip="158.153.61.199" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="118.216.8.38"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.130460,1.371720,504,1 1 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="186.255.236.59" dst_port="443"/>
            <filter src_ip="186.255.236.59" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.076260,1.350020,504,1 0 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="191.49.119.49" dst_ip="34.142.43.203"/>
            <filter src_ip="191.49.119.49" dst_port="443"/>
            <filter src_ip="191.49.119.49" dst_port="80"/>
            <filter dst_ip="34.142.43.203" dst_port="443"/>
            <filter dst_ip="34.142.43.203" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,999,0 0 0 0 0 0 0 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="161.97.30.92" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.358900,1.533800,503,0 0 0 0 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="173.53.109.210" dst_ip="169.46.93.80"/>
            <filter src_ip="173.53.109.210" src_port="80"/>
            <filter dst_ip="169.46.93.80" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="212.225.251.249"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="222.89.183.222"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="220.195.12.194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,502,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="200.56.140.212"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="59.244.239.162"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,502,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="54.65.215.147"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,504,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="54.85.19.93"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="76.200.222.201"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="81.124.97.12"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="186.255.191.185"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.076260,1.350020,503,1 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="161.56.4.129" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,504,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="161.56.43.47"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,503,0 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.46.93.12"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,503,0 0 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="13.133.229.127" src_port="80"/>
            <filter dst_ip="158.153.140.95" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.076260,1.350020,010,1 0 0 0 0 0 0 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.99.204.238" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.130460,1.371720,010,1 1 0 0 0 0 0 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="90.125.247.236" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="215.37.251.56"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,503,0 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="221.80.175.90"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.076260,1.350020,999,1 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="183.219.21.200" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.199480,1.412900,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="158.153.142.0" src_port="80"/>
            <filter dst_ip="158.153.142.0" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.076260,1.350020,503,1 0 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="154.88.175.188" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.009470,2.434110,504,1 1 0 1 1 1 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="4.56.99.25" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218894"/>
    </anomaly>
    <anomaly type="anomalous" value="3.861290,2.986770,503,1 1 1 1 1 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="221.91.175.172" src_port="80"/>
            <filter dst_ip="221.91.175.172" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.034220,2.489550,504,1 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="158.153.142.118" src_port="41691"/>
            <filter src_ip="158.153.142.118" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.053870,2.501390,504,1 1 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="158.153.90.9" dst_port="443"/>
            <filter src_ip="158.153.90.9" dst_port="80"/>
            <filter dst_ip="211.158.174.244" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.327870,3.310470,503,1 1 1 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="161.56.71.35" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.435830,1.990300,999,1 1 1 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="86.15.247.87" src_port="39007" dst_port="5093"/>
            <filter src_ip="195.13.135.239" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.710970,1.624910,503,1 0 0 1 0 0 1 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="128.93.87.4" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.357440,2.667500,010,1 1 1 1 0 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="119.104.175.223" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.327870,3.310470,503,1 1 1 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="221.80.65.230" src_port="80"/>
            <filter dst_ip="221.80.65.230" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.134400,1.890390,504,0 0 0 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="220.240.69.88" src_port="443"/>
            <filter dst_ip="221.80.65.14" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.745570,1.642980,503,1 1 0 1 0 0 1 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="221.80.65.230" dst_port="443"/>
            <filter src_ip="221.80.65.230" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.904680,1.784190,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218828"/>
    </anomaly>
    <anomaly type="anomalous" value="1.904680,1.784190,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218828"/>
    </anomaly>
    <anomaly type="anomalous" value="3.536580,2.863970,503,1 0 0 0 1 1 0 0 0 0 0 1,ntscACK">
        <slice>
            <filter src_ip="154.88.175.202" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.968150,2.383970,999,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="109.131.30.48" dst_ip="161.56.103.170"/>
        </slice>
        <from usec="0" sec="1447218465"/>
        <to usec="0" sec="1447218469"/>
    </anomaly>
    <anomaly type="anomalous" value="2.968150,2.383970,504,0 0 0 1 1 1 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="158.153.41.172" dst_ip="101.167.236.82" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218161"/>
        <to usec="0" sec="1447218643"/>
    </anomaly>
    <anomaly type="anomalous" value="2.968150,2.383970,504,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="221.80.173.199" src_port="80"/>
            <filter dst_ip="221.80.173.199" src_port="443"/>
        </slice>
        <from usec="0" sec="1447218524"/>
        <to usec="0" sec="1447218633"/>
    </anomaly>
    <anomaly type="anomalous" value="3.730510,2.857860,999,1 1 0 1 1 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter src_ip="109.131.54.96" dst_ip="191.40.114.223"/>
            <filter dst_ip="191.40.114.223" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.233620,1.909140,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="220.74.7.127" dst_ip="220.240.66.150" src_port="53"/>
            <filter src_ip="220.74.7.126" dst_ip="220.240.66.150" src_port="53"/>
        </slice>
        <from usec="0" sec="1447218006"/>
        <to usec="0" sec="1447218799"/>
    </anomaly>
    <anomaly type="anomalous" value="2.054110,1.942380,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218828"/>
    </anomaly>
    <anomaly type="anomalous" value="2.054110,1.942380,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218828"/>
    </anomaly>
    <anomaly type="anomalous" value="3.138500,2.438280,503,0 0 0 1 1 1 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="66.8.247.92" dst_ip="186.255.9.245" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.230650,3.212550,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="66.8.247.99" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.138500,2.438280,503,0 0 0 1 1 1 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="42.245.115.94" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.968150,2.383970,504,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="211.158.174.244" dst_ip="158.153.15.35" src_port="443"/>
        </slice>
        <from usec="0" sec="1447218006"/>
        <to usec="0" sec="1447218457"/>
    </anomaly>
    <anomaly type="anomalous" value="3.504110,2.644340,010,1 0 0 1 1 1 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="91.205.6.62" dst_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.138500,2.438280,503,0 0 0 1 1 1 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="158.153.143.46"/>
            <filter src_ip="8.196.104.68" dst_ip="221.80.65.230" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.968150,2.383970,503,0 0 0 1 1 1 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="186.255.189.205" dst_ip="13.174.241.6" dst_port="80"/>
            <filter src_ip="186.255.169.208" dst_ip="13.174.241.6" dst_port="80"/>
            <filter src_ip="186.255.11.89" dst_ip="13.174.241.6" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218632"/>
    </anomaly>
    <anomaly type="anomalous" value="2.968150,2.383970,999,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="123.2.65.4" dst_ip="161.56.193.126" src_port="51894" dst_port="34476"/>
            <filter src_ip="123.2.65.4" dst_ip="161.56.193.126" src_port="51890" dst_port="34476"/>
            <filter src_ip="123.2.65.4" dst_ip="161.56.193.126" src_port="51835" dst_port="34476"/>
            <filter src_ip="123.2.65.4" dst_ip="161.56.193.126" src_port="18418" dst_port="443"/>
            <filter src_ip="123.2.65.4" dst_ip="161.56.193.126" src_port="16433" dst_port="34476"/>
        </slice>
        <from usec="0" sec="1447218075"/>
        <to usec="0" sec="1447218648"/>
    </anomaly>
    <anomaly type="anomalous" value="2.920530,2.347250,503,1 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="191.49.124.24" dst_ip="4.56.102.47" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218119"/>
        <to usec="0" sec="1447218680"/>
    </anomaly>
    <anomaly type="anomalous" value="1.673320,1.567730,504,0 0 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="186.255.120.206" dst_port="53"/>
            <filter src_ip="186.255.120.206" dst_ip="144.173.251.183" dst_port="443"/>
            <filter src_ip="186.255.120.206" dst_ip="144.173.251.149" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.543900,2.676980,503,0 0 0 1 1 1 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="154.88.175.191" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.067660,1.843870,503,1 0 0 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="154.88.175.189" src_port="80"/>
            <filter dst_ip="161.56.165.157" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.681400,1.667840,504,1 0 0 0 0 0 0 0 0 0 1 0,alphfl">
        <slice>
            <filter src_ip="211.158.174.244" dst_ip="221.91.175.172" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.067660,1.843870,504,1 0 0 0 0 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="169.46.6.243" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.230650,3.212550,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="34.49.201.251" dst_ip="161.56.185.96"/>
            <filter src_ip="34.49.201.251" src_port="80"/>
            <filter src_ip="66.8.240.231" src_port="80"/>
            <filter dst_ip="161.56.185.96" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.138500,2.438280,503,0 0 0 1 1 1 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="66.8.240.220" src_port="80"/>
            <filter dst_ip="161.56.197.74" src_port="80"/>
            <filter dst_ip="161.56.197.74" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.212320,2.647700,999,1 1 1 0 0 0 1 0 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="137.241.219.120" src_port="5073" dst_port="5060"/>
            <filter src_ip="137.241.219.120" src_port="5085" dst_port="5060"/>
            <filter src_ip="137.241.219.120" src_port="5084" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.197370,3.185400,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="186.255.157.229" src_port="80"/>
            <filter dst_ip="186.255.189.205" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.034220,2.489550,503,1 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="158.153.15.17" src_port="80"/>
            <filter dst_ip="158.153.15.17" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.034220,2.489550,504,1 0 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="92.105.0.159" dst_port="23"/>
            <filter src_ip="107.201.66.173" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.928740,2.239000,999,1 1 0 1 1 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="220.240.73.84" src_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.036620,1.793690,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="66.8.247.82" dst_ip="186.255.169.157" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.745570,1.642980,504,1 1 0 1 0 0 1 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="186.255.157.229" dst_port="80"/>
            <filter src_ip="186.255.157.229" dst_port="443"/>
            <filter src_ip="186.255.189.205" dst_port="80"/>
            <filter src_ip="186.255.189.205" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.036620,1.793690,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="119.194.20.159" dst_ip="221.80.176.202" src_port="80" dst_port="53897"/>
            <filter src_ip="119.194.20.159" dst_ip="221.80.176.202" src_port="80" dst_port="53896"/>
            <filter src_ip="119.194.20.159" dst_ip="158.153.42.204" src_port="80" dst_port="63982"/>
            <filter src_ip="119.194.20.159" dst_ip="158.153.42.204" src_port="80" dst_port="63939"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.036620,1.793690,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYNt">
        <slice>
            <filter src_ip="210.143.152.70" src_port="34680"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.036620,1.793690,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="34.4.252.188" dst_ip="158.153.141.122" src_port="443" dst_port="56887"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.036620,1.793690,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="34.32.188.170" dst_ip="169.46.6.243" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.036620,1.793690,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="34.32.184.186" dst_ip="158.153.141.147" src_port="80" dst_port="57226"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.036620,1.793690,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="158.153.61.104" src_port="443"/>
            <filter src_ip="46.154.164.136" dst_ip="158.153.61.104" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.034220,2.489550,503,1 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="221.80.65.68" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.036620,1.793690,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="68.18.208.197" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.080090,2.524200,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="125.53.211.186" dst_ip="186.255.120.97" src_port="443" dst_port="2565"/>
            <filter src_ip="125.53.211.186" dst_ip="186.255.120.97" src_port="443" dst_port="2564"/>
            <filter src_ip="125.53.211.186" dst_ip="186.255.120.97" src_port="443" dst_port="2563"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.624550,1.530730,503,1 1 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="186.255.254.35" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
