<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.469080,1.850640,503,1 1 1 1 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="202.43.85.2" dst_port="80"/>
            <filter src_ip="202.43.85.2" dst_port="443"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390089"/>
    </anomaly>
    <anomaly type="suspicious" value="1.630020,1.876710,999,1 1 1 1 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="218.248.60.150" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.411260,1.824150,504,1 1 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="31.242.249.79" dst_port="443"/>
            <filter src_ip="157.166.186.84" dst_ip="31.242.248.254" dst_port="443"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390089"/>
    </anomaly>
    <anomaly type="suspicious" value="1.902710,1.977980,503,1 1 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="80"/>
            <filter dst_ip="31.242.248.240" dst_port="443"/>
            <filter dst_ip="31.242.250.55" dst_port="443"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390100"/>
    </anomaly>
    <anomaly type="suspicious" value="1.417610,1.881550,504,1 1 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter src_ip="133.152.68.16" dst_port="80"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390097"/>
    </anomaly>
    <anomaly type="suspicious" value="1.400620,1.890030,503,1 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="163.44.209.40" dst_port="443"/>
            <filter src_ip="163.44.209.40" dst_port="80"/>
            <filter dst_ip="204.102.225.83" dst_port="443"/>
        </slice>
        <from usec="0" sec="1454389201"/>
        <to usec="0" sec="1454390070"/>
    </anomaly>
    <anomaly type="suspicious" value="1.411260,1.824150,504,1 1 0 1 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="182.187.70.200" src_port="443"/>
            <filter src_ip="182.187.70.202" src_port="443"/>
        </slice>
        <from usec="0" sec="1454389205"/>
        <to usec="0" sec="1454390028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.586470,1.885350,999,1 1 1 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="130.194.224.40" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.533090,1.859360,503,1 1 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="203.122.86.228" dst_ip="163.44.129.15" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.475180,1.907240,999,1 1 1 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="202.34.62.135" src_port="25"/>
            <filter src_ip="202.34.62.135" dst_port="25"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.533090,1.859360,999,1 1 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="202.34.179.95" dst_ip="167.206.233.121" dst_port="80"/>
            <filter src_ip="202.34.179.95" dst_ip="17.131.216.68" dst_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.630020,1.876710,503,1 1 1 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.44.204.72" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.533090,1.859360,503,1 1 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="199.60.81.201" dst_ip="202.34.182.146" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.533090,1.859360,503,1 1 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="133.139.175.90" dst_ip="65.99.241.18" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.533090,1.859360,504,1 1 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="157.166.14.227" dst_port="443"/>
            <filter src_ip="157.166.14.227" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.360730,1.833040,503,1 1 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="178.63.46.64" dst_ip="202.34.62.145" dst_port="80"/>
        </slice>
        <from usec="0" sec="1454389558"/>
        <to usec="0" sec="1454389619"/>
    </anomaly>
    <anomaly type="suspicious" value="1.469080,1.850640,010,1 1 1 1 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="221.1.141.1" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1454389605"/>
        <to usec="0" sec="1454389665"/>
    </anomaly>
    <anomaly type="suspicious" value="1.475180,1.907240,010,1 1 1 1 1 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="117.118.104.80" dst_port="23"/>
        </slice>
        <from usec="0" sec="1454389852"/>
        <to usec="0" sec="1454389890"/>
    </anomaly>
    <anomaly type="suspicious" value="1.475180,1.907240,999,1 1 1 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="187.37.130.89" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1454389731"/>
        <to usec="0" sec="1454389745"/>
    </anomaly>
    <anomaly type="suspicious" value="1.578110,1.850610,010,1 1 0 1 0 0 0 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="79.190.14.43" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.458860,1.915600,502,1 0 1 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="193.200.20.169" src_port="22"/>
        </slice>
        <from usec="0" sec="1454389219"/>
        <to usec="0" sec="1454390002"/>
    </anomaly>
    <anomaly type="suspicious" value="1.469080,1.850640,020,1 1 1 1 0 0 1 0 0 0 0 0,ttl_error">
        <slice>
            <filter src_ip="150.67.136.182"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390059"/>
    </anomaly>
    <anomaly type="suspicious" value="1.400620,1.890030,504,1 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="210.115.130.75" dst_ip="202.34.183.223" src_port="443" dst_port="35021"/>
        </slice>
        <from usec="0" sec="1454389342"/>
        <to usec="0" sec="1454389356"/>
    </anomaly>
    <anomaly type="suspicious" value="1.417610,1.881550,503,1 1 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.44.129.15" dst_ip="202.204.110.156" dst_port="80"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390087"/>
    </anomaly>
    <anomaly type="suspicious" value="1.411260,1.824150,999,1 1 0 1 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.81.137.66" src_port="53"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390027"/>
    </anomaly>
    <anomaly type="suspicious" value="1.902710,1.977980,999,1 1 0 1 1 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.81.154.0" dst_port="53"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390048"/>
    </anomaly>
    <anomaly type="suspicious" value="1.400620,1.890030,010,1 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="79.113.253.54" dst_port="23"/>
        </slice>
        <from usec="0" sec="1454389780"/>
        <to usec="0" sec="1454389882"/>
    </anomaly>
    <anomaly type="suspicious" value="1.469080,1.850640,020,1 1 1 1 0 0 1 0 0 0 0 0,ttl_error">
        <slice>
            <filter src_ip="150.67.136.171"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390035"/>
    </anomaly>
    <anomaly type="suspicious" value="1.517390,1.867950,999,1 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="14.29.87.212" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.562870,1.859230,503,1 0 0 1 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="69.57.12.219" dst_ip="133.152.148.159" src_port="80"/>
            <filter src_ip="104.233.24.44" dst_ip="133.152.148.159" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.405590,1.930850,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.400620,1.890030,504,1 0 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.44.128.99" dst_port="443"/>
        </slice>
        <from usec="0" sec="1454389203"/>
        <to usec="0" sec="1454389690"/>
    </anomaly>
    <anomaly type="suspicious" value="1.400620,1.890030,504,1 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="69.132.202.42" dst_ip="150.5.136.132" src_port="443" dst_port="49558"/>
            <filter src_ip="69.132.202.42" dst_ip="150.5.136.132" src_port="443" dst_port="49557"/>
            <filter src_ip="69.132.202.42" dst_ip="150.5.136.132" src_port="443" dst_port="49555"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389730"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="182.52.88.164" dst_ip="133.132.247.123" src_port="46117" dst_port="20928"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389360"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="157.166.10.27" src_port="1863"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389398"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="176.60.132.53" dst_port="445"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389398"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="167.231.14.213" dst_port="445"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389398"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="156.149.181.66" src_port="53"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389398"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="52.151.87.108" src_port="80"/>
        </slice>
        <from usec="0" sec="1454389212"/>
        <to usec="0" sec="1454389396"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="163.44.204.106" dst_port="80"/>
        </slice>
        <from usec="0" sec="1454389219"/>
        <to usec="0" sec="1454389360"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="104.186.238.226" dst_ip="202.34.183.41" src_port="51413" dst_port="43611"/>
        </slice>
        <from usec="0" sec="1454389228"/>
        <to usec="0" sec="1454389397"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="124.213.75.90" dst_ip="203.81.132.106" src_port="80"/>
            <filter src_ip="124.213.75.90" dst_ip="203.81.137.127" src_port="80"/>
        </slice>
        <from usec="0" sec="1454389237"/>
        <to usec="0" sec="1454389390"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="68.69.226.9" dst_ip="202.34.183.41" src_port="51413" dst_port="43611"/>
        </slice>
        <from usec="0" sec="1454389239"/>
        <to usec="0" sec="1454389392"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="126.60.205.164" dst_ip="202.34.62.137" dst_port="443"/>
        </slice>
        <from usec="0" sec="1454389255"/>
        <to usec="0" sec="1454389271"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="211.197.61.62" dst_ip="163.44.66.88" src_port="35128"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389484"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.152.169.40" dst_ip="37.27.33.21" src_port="35388"/>
        </slice>
        <from usec="0" sec="1454389201"/>
        <to usec="0" sec="1454389475"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="153.14.107.145" dst_ip="133.152.68.16" src_port="80"/>
            <filter src_ip="153.14.107.145" dst_ip="133.152.68.21" src_port="80"/>
        </slice>
        <from usec="0" sec="1454389223"/>
        <to usec="0" sec="1454389482"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="180.156.124.77" dst_ip="150.5.138.243" src_port="80"/>
        </slice>
        <from usec="0" sec="1454389236"/>
        <to usec="0" sec="1454389482"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="74.54.153.94" dst_ip="157.166.99.65" src_port="80"/>
        </slice>
        <from usec="0" sec="1454389930"/>
        <to usec="0" sec="1454390026"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.81.139.136" dst_port="53"/>
            <filter src_ip="203.81.139.136" dst_port="443"/>
            <filter src_ip="203.81.139.136" dst_port="80"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389578"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,020,0 0 0 1 1 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="195.7.193.75"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390022"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="115.71.167.168" dst_ip="203.81.129.150" src_port="58006" dst_port="993"/>
            <filter src_ip="115.71.167.168" dst_ip="203.81.129.150" src_port="45654" dst_port="993"/>
            <filter src_ip="115.71.167.168" dst_ip="203.81.129.150" src_port="37360" dst_port="993"/>
            <filter src_ip="115.71.167.168" dst_ip="203.81.143.81" src_port="57188" dst_port="80"/>
            <filter src_ip="115.71.167.168" dst_ip="203.81.143.83" src_port="61734" dst_port="161"/>
        </slice>
        <from usec="0" sec="1454389207"/>
        <to usec="0" sec="1454389578"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="49.58.68.108" dst_ip="202.34.62.137" dst_port="443"/>
        </slice>
        <from usec="0" sec="1454389487"/>
        <to usec="0" sec="1454389521"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="31.242.229.255" dst_ip="131.230.49.66" src_port="80" dst_port="4323"/>
            <filter src_ip="31.242.229.255" dst_ip="131.230.49.66" src_port="80" dst_port="3699"/>
            <filter src_ip="31.242.229.255" dst_ip="131.230.49.66" src_port="80" dst_port="2859"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389533"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="71.134.81.198" src_port="34680"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389668"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="186.97.155.103" dst_port="445"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389667"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="114.216.77.121" dst_port="445"/>
        </slice>
        <from usec="0" sec="1454389201"/>
        <to usec="0" sec="1454390028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="77.10.6.104" src_port="65340" dst_port="80"/>
            <filter src_ip="77.10.6.104" src_port="4944" dst_port="80"/>
            <filter src_ip="77.10.6.104" src_port="30388" dst_port="80"/>
        </slice>
        <from usec="0" sec="1454389202"/>
        <to usec="0" sec="1454389758"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="67.221.85.142" dst_ip="157.166.99.75" src_port="80" dst_port="46536"/>
        </slice>
        <from usec="0" sec="1454389492"/>
        <to usec="0" sec="1454389497"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="182.171.103.55" dst_ip="202.34.183.41" src_port="34136" dst_port="43611"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389755"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,502,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.152.146.182" dst_ip="211.210.184.128" src_port="22"/>
        </slice>
        <from usec="0" sec="1454389201"/>
        <to usec="0" sec="1454389756"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,020,0 0 0 1 1 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="221.243.200.192"/>
        </slice>
        <from usec="0" sec="1454389201"/>
        <to usec="0" sec="1454389757"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="54.31.197.230" dst_port="22"/>
        </slice>
        <from usec="0" sec="1454389203"/>
        <to usec="0" sec="1454389758"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="103.60.35.91" dst_ip="150.5.255.80" src_port="443"/>
        </slice>
        <from usec="0" sec="1454389203"/>
        <to usec="0" sec="1454389756"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.152.231.237" dst_ip="195.105.216.239" dst_port="80"/>
            <filter src_ip="133.152.231.237" dst_ip="217.103.150.205" dst_port="443"/>
        </slice>
        <from usec="0" sec="1454389204"/>
        <to usec="0" sec="1454389751"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="185.167.92.233" dst_port="23"/>
        </slice>
        <from usec="0" sec="1454389209"/>
        <to usec="0" sec="1454389937"/>
    </anomaly>
    <anomaly type="suspicious" value="1.400620,1.890030,999,1 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="210.124.141.227" dst_ip="202.43.85.121" src_port="25" dst_port="64239"/>
            <filter src_ip="210.124.141.227" dst_ip="202.43.85.121" src_port="25" dst_port="33944"/>
            <filter src_ip="210.124.141.227" dst_ip="202.34.62.135" src_port="25" dst_port="56627"/>
            <filter src_ip="210.124.141.227" dst_ip="163.44.168.167" src_port="25" dst_port="56378"/>
            <filter src_ip="210.124.141.227" dst_ip="163.44.168.176" src_port="25" dst_port="35059"/>
        </slice>
        <from usec="0" sec="1454389516"/>
        <to usec="0" sec="1454389707"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="216.100.109.110" dst_ip="163.44.12.230" src_port="80" dst_port="58815"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389848"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="201.212.70.8" dst_port="445"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389848"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.152.1.11" src_port="53"/>
        </slice>
        <from usec="0" sec="1454389203"/>
        <to usec="0" sec="1454389839"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,504,0 0 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="108.64.80.130" src_port="443"/>
        </slice>
        <from usec="0" sec="1454389205"/>
        <to usec="0" sec="1454389848"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="157.166.223.89" dst_ip="17.167.133.120" dst_port="993"/>
        </slice>
        <from usec="0" sec="1454389215"/>
        <to usec="0" sec="1454389808"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.139.213.132" dst_ip="31.242.253.52" dst_port="80"/>
            <filter src_ip="133.139.213.132" dst_ip="31.242.253.52" dst_port="443"/>
        </slice>
        <from usec="0" sec="1454389524"/>
        <to usec="0" sec="1454389817"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,504,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="202.34.167.31" dst_ip="31.242.245.15"/>
            <filter src_ip="202.34.167.31" dst_port="80"/>
            <filter src_ip="202.34.167.31" dst_port="443"/>
            <filter dst_ip="31.242.245.15" dst_port="80"/>
            <filter dst_ip="31.242.245.15" dst_port="443"/>
        </slice>
        <from usec="0" sec="1454389538"/>
        <to usec="0" sec="1454389843"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,010,0 0 0 1 1 0 0 0 0 0 0 0,sptpDoSSYN">
        <slice>
            <filter src_ip="162.216.65.209" dst_ip="157.166.132.227" dst_port="6851"/>
        </slice>
        <from usec="0" sec="1454389609"/>
        <to usec="0" sec="1454389823"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="177.177.79.137" dst_ip="133.139.195.15" dst_port="53"/>
            <filter src_ip="177.177.79.137" dst_ip="131.230.191.251" dst_port="53"/>
            <filter src_ip="177.177.79.137" dst_ip="157.166.253.36" dst_port="53"/>
        </slice>
        <from usec="0" sec="1454389654"/>
        <to usec="0" sec="1454389846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.44.95.234" dst_ip="157.223.58.204" src_port="80" dst_port="2088"/>
        </slice>
        <from usec="0" sec="1454389669"/>
        <to usec="0" sec="1454389805"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="199.93.0.233" dst_ip="157.166.99.68" src_port="80"/>
            <filter src_ip="199.93.0.233" dst_ip="157.166.99.21" src_port="80"/>
        </slice>
        <from usec="0" sec="1454389680"/>
        <to usec="0" sec="1454389848"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="216.97.30.53" dst_ip="150.5.198.223" src_port="80"/>
        </slice>
        <from usec="0" sec="1454389697"/>
        <to usec="0" sec="1454389773"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="211.159.4.191" dst_ip="150.5.50.114" src_port="28009" dst_port="7459"/>
        </slice>
        <from usec="0" sec="1454389716"/>
        <to usec="0" sec="1454389764"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,503,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="107.185.241.235" dst_ip="202.34.181.122" src_port="80" dst_port="52380"/>
            <filter src_ip="107.185.241.235" dst_ip="202.34.181.122" src_port="80" dst_port="52379"/>
            <filter src_ip="107.185.241.235" dst_ip="202.34.181.122" src_port="80" dst_port="52367"/>
            <filter src_ip="107.185.241.235" dst_ip="202.34.181.122" src_port="80" dst_port="52366"/>
        </slice>
        <from usec="0" sec="1454389719"/>
        <to usec="0" sec="1454389726"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="202.34.183.224" dst_port="443"/>
            <filter src_ip="202.34.183.224" dst_ip="17.167.141.60" dst_port="993"/>
        </slice>
        <from usec="0" sec="1454389238"/>
        <to usec="0" sec="1454389844"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="62.2.192.15" dst_port="445"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="163.44.78.56" dst_port="80"/>
            <filter src_ip="163.44.78.56" dst_port="443"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390021"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,020,0 0 0 1 1 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="203.81.135.126"/>
        </slice>
        <from usec="0" sec="1454389202"/>
        <to usec="0" sec="1454390016"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="163.44.129.89" dst_port="443"/>
        </slice>
        <from usec="0" sec="1454389202"/>
        <to usec="0" sec="1454390023"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="195.219.84.159" dst_ip="157.166.39.99"/>
            <filter src_ip="195.219.84.159" src_port="3478"/>
            <filter dst_ip="157.166.39.99" src_port="3478"/>
        </slice>
        <from usec="0" sec="1454389209"/>
        <to usec="0" sec="1454390021"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,020,0 0 0 1 1 0 0 0 0 0 0 0,ntscICecrqICterp">
        <slice>
            <filter src_ip="129.58.140.160" dst_ip="203.81.134.51"/>
            <filter src_ip="129.58.140.160" dst_ip="203.81.140.4"/>
        </slice>
        <from usec="0" sec="1454389219"/>
        <to usec="0" sec="1454390019"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,503,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="163.44.123.18" dst_port="80"/>
            <filter dst_ip="140.33.14.139" dst_port="80"/>
            <filter src_ip="163.44.123.18" dst_ip="140.33.14.139" dst_port="443"/>
        </slice>
        <from usec="0" sec="1454389225"/>
        <to usec="0" sec="1454389977"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="204.202.144.252" src_port="53"/>
        </slice>
        <from usec="0" sec="1454389256"/>
        <to usec="0" sec="1454390020"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="182.185.134.76" dst_ip="150.5.50.195" src_port="1119" dst_port="51548"/>
        </slice>
        <from usec="0" sec="1454389745"/>
        <to usec="0" sec="1454389986"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454570,1.922420,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="103.130.247.59" dst_ip="150.5.49.208" src_port="80"/>
            <filter src_ip="103.130.247.59" dst_ip="133.152.68.16" src_port="80"/>
        </slice>
        <from usec="0" sec="1454389776"/>
        <to usec="0" sec="1454389960"/>
    </anomaly>
    <anomaly type="suspicious" value="1.405590,1.930850,504,0 0 0 0 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="202.34.181.70" dst_port="443"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389455"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="89.245.59.72" dst_ip="133.139.127.194" dst_port="53"/>
            <filter src_ip="107.121.179.185" dst_ip="133.139.127.194" dst_port="53"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.343020,1.841740,999,1 0 0 0 0 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="96.209.79.32" dst_ip="157.166.143.13" dst_port="53"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.448380,1.866280,999,0 0 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="184.148.7.76" src_port="53"/>
            <filter dst_ip="203.81.137.66" src_port="53"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389398"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="150.5.254.151"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="150.5.253.165"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.360730,1.833040,999,1 1 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="157.166.253.36" src_port="53"/>
            <filter dst_ip="157.166.253.36" dst_port="53"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389600"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="209.98.73.97"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.81.139.190"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.343020,1.841740,503,1 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="58.163.3.186" dst_ip="150.5.126.42" dst_port="80"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390084"/>
    </anomaly>
    <anomaly type="suspicious" value="1.930400,2.016900,503,0 0 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="157.166.99.25" src_port="80"/>
            <filter dst_ip="157.166.99.21" src_port="80"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389654"/>
    </anomaly>
    <anomaly type="suspicious" value="1.448380,1.866280,010,0 0 0 1 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="46.163.88.100" src_port="54820" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389308"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="203.81.133.234"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.448380,1.866280,999,0 0 0 1 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.5.51.203" dst_port="16001"/>
            <filter dst_ip="150.5.51.203" dst_port="12913"/>
        </slice>
        <from usec="0" sec="1454389220"/>
        <to usec="0" sec="1454389845"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.81.135.27" src_port="53"/>
            <filter dst_ip="203.81.135.27" dst_port="53"/>
        </slice>
        <from usec="0" sec="1454389290"/>
        <to usec="0" sec="1454389336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.5.252.125" dst_port="54770"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.448380,1.866280,503,0 0 0 1 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="157.166.99.75" src_port="80"/>
        </slice>
        <from usec="0" sec="1454389290"/>
        <to usec="0" sec="1454389481"/>
    </anomaly>
    <anomaly type="suspicious" value="1.448380,1.866280,020,0 0 0 1 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="203.81.134.51" src_port="53"/>
            <filter dst_ip="203.81.134.51"/>
        </slice>
        <from usec="0" sec="1454389203"/>
        <to usec="0" sec="1454390028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.67.195.13" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1454389290"/>
        <to usec="0" sec="1454389336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.448380,1.866280,999,0 0 0 1 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="216.250.89.28" dst_ip="131.230.134.131" src_port="53"/>
            <filter src_ip="216.250.89.28" dst_ip="131.230.63.121" src_port="53"/>
        </slice>
        <from usec="0" sec="1454389245"/>
        <to usec="0" sec="1454389739"/>
    </anomaly>
    <anomaly type="suspicious" value="1.890080,1.986050,504,1 0 0 1 1 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.81.137.127" dst_port="443"/>
            <filter src_ip="203.81.137.127" dst_port="80"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="203.81.133.234"/>
        </slice>
        <from usec="0" sec="1454389290"/>
        <to usec="0" sec="1454389336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="150.5.11.88"/>
        </slice>
        <from usec="0" sec="1454389560"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.394200,1.832900,503,1 0 0 1 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.44.12.251" src_port="80"/>
        </slice>
        <from usec="0" sec="1454389202"/>
        <to usec="0" sec="1454389860"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.5.129.50"/>
        </slice>
        <from usec="0" sec="1454389560"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.44.31.79" src_port="80"/>
        </slice>
        <from usec="0" sec="1454389560"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.81.139.180"/>
        </slice>
        <from usec="0" sec="1454389560"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,011,0 0 0 0 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="23.63.176.16" dst_ip="133.139.18.185" src_port="6667"/>
        </slice>
        <from usec="0" sec="1454389290"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="150.5.22.195" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="150.5.71.157"/>
        </slice>
        <from usec="0" sec="1454389560"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="150.5.21.102"/>
        </slice>
        <from usec="0" sec="1454389560"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="150.5.147.23"/>
        </slice>
        <from usec="0" sec="1454389560"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.43.116.7"/>
        </slice>
        <from usec="0" sec="1454389560"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.448380,1.866280,503,0 0 0 1 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="157.166.99.69" src_port="80"/>
        </slice>
        <from usec="0" sec="1454389308"/>
        <to usec="0" sec="1454390011"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="133.139.252.100"/>
        </slice>
        <from usec="0" sec="1454389560"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.67.140.82"/>
        </slice>
        <from usec="0" sec="1454389560"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.5.128.175"/>
        </slice>
        <from usec="0" sec="1454389560"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.448380,1.866280,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.81.130.57" dst_port="53"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389938"/>
    </anomaly>
    <anomaly type="suspicious" value="1.343020,1.841740,503,1 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.44.143.227" dst_ip="202.42.113.40" dst_port="80"/>
        </slice>
        <from usec="0" sec="1454389560"/>
        <to usec="0" sec="1454389621"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.67.195.13" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1454389560"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="185.121.246.61"/>
        </slice>
        <from usec="0" sec="1454389650"/>
        <to usec="0" sec="1454389696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_port="555" dst_port="123"/>
        </slice>
        <from usec="0" sec="1454389740"/>
        <to usec="0" sec="1454389786"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="185.121.246.61" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1454389785"/>
        <to usec="0" sec="1454389831"/>
    </anomaly>
    <anomaly type="suspicious" value="1.399190,1.874970,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.5.11.33" dst_port="20894"/>
        </slice>
        <from usec="0" sec="1454389560"/>
        <to usec="0" sec="1454389876"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420600,1.859390,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="199.178.147.12" src_port="5555" dst_port="6054"/>
            <filter src_ip="199.178.147.12" src_port="5658" dst_port="6054"/>
        </slice>
        <from usec="0" sec="1454389853"/>
        <to usec="0" sec="1454390101"/>
    </anomaly>
    <anomaly type="suspicious" value="1.567330,1.900710,504,0 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="119.244.37.85"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.931320,2.028780,999,1 0 0 0 0 0 0 0 0 0 1 0,ntscUDP">
        <slice>
            <filter src_ip="202.34.180.112" src_port="6881"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.517390,1.867950,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="212.248.53.70" dst_ip="150.5.111.82" src_port="80" dst_port="51084"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.567330,1.900710,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="221.50.246.116"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.586470,1.885350,999,1 1 1 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="73.97.19.237" dst_ip="150.5.62.221" src_port="58868" dst_port="16401"/>
            <filter src_ip="73.97.19.237" dst_ip="150.5.62.221" src_port="50336" dst_port="16401"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.517390,1.867950,504,1 0 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="74.246.208.227" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.567330,1.900710,502,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="119.21.108.188"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.567330,1.900710,999,0 0 0 0 0 0 0 0 0 1 0 0,ipv46tun">
        <slice>
            <filter dst_ip="149.147.186.143"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.611400,1.892150,503,0 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="54.48.145.148" src_port="80"/>
            <filter src_ip="54.48.145.148" src_port="443"/>
            <filter dst_ip="163.44.130.202" src_port="80"/>
            <filter dst_ip="163.44.130.202" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420600,1.859390,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="111.9.16.97" src_port="12200" dst_port="61111"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389523"/>
    </anomaly>
    <anomaly type="suspicious" value="1.578110,1.850610,504,1 1 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="202.34.181.167" dst_port="443"/>
            <filter src_ip="163.44.128.158" dst_ip="17.131.221.3" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.611400,1.892150,504,0 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="17.153.195.167" src_port="443"/>
            <filter dst_ip="202.34.180.172" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.567330,1.900710,999,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="203.81.130.220" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.586470,1.885350,503,1 1 1 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="203.81.142.54" dst_ip="36.68.152.75" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.517390,1.867950,504,1 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="133.152.186.34" dst_ip="52.152.102.174" dst_port="443"/>
            <filter src_ip="133.152.186.34" dst_ip="52.186.174.120" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.567330,1.900710,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="5.170.168.91"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.582530,1.892280,999,0 1 0 0 0 0 0 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="202.34.180.112" src_port="6881"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.611400,1.892150,503,0 0 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.44.13.45" src_port="80"/>
            <filter dst_ip="163.44.13.45" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.603770,3.426520,503,1 1 1 1 1 0 1 1 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="182.187.70.199" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.896240,2.964530,504,1 1 1 1 1 0 1 1 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="31.242.253.52" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.930300,2.920240,503,1 1 1 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.43.114.113"/>
            <filter dst_ip="202.34.56.159" src_port="443"/>
            <filter dst_ip="202.34.56.159" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.909060,2.903530,503,1 1 0 1 1 0 1 0 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="27.23.61.138" dst_ip="203.81.139.172" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.460460,2.156540,503,1 1 1 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="155.123.234.141" dst_ip="202.34.177.106" src_port="80"/>
            <filter src_ip="155.123.234.140" dst_ip="202.34.177.106" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.733630,4.625360,503,1 1 1 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="150.5.124.122" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.603770,3.426520,503,1 1 1 1 1 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.81.134.127" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.930300,2.920240,010,1 1 1 1 1 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="222.181.70.138" src_port="6000" dst_port="2222"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.449830,2.739700,503,1 1 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="63.23.105.119" dst_ip="150.5.45.141" dst_port="80"/>
            <filter src_ip="63.19.237.109" dst_ip="150.5.45.141" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.031640,1.981590,503,1 1 1 0 0 0 1 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="203.81.139.172" dst_ip="199.252.15.217" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.473880,2.757400,999,1 1 1 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="133.152.222.158" src_port="62439"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.427570,4.062470,999,1 1 1 1 1 1 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="24.19.182.158" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1454389214"/>
        <to usec="0" sec="1454389465"/>
    </anomaly>
    <anomaly type="anomalous" value="2.426380,2.133860,504,1 1 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="202.34.178.35" dst_ip="38.204.89.72" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.585650,3.412300,503,1 1 0 1 1 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="202.34.56.159" src_port="80"/>
            <filter dst_ip="202.34.56.159" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.412290,2.773510,503,1 1 1 1 1 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="182.187.70.199" src_port="80"/>
            <filter src_ip="182.187.70.194" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.719750,2.855810,010,1 1 1 1 1 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="192.247.242.238" dst_port="23"/>
            <filter src_ip="192.247.242.238" dst_port="1433"/>
            <filter src_ip="192.247.242.238" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.576500,4.574330,503,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.44.209.40" src_port="80"/>
            <filter dst_ip="163.44.209.40" src_port="443"/>
            <filter dst_ip="163.44.39.46" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.470070,2.733770,999,1 1 0 1 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.81.134.134" dst_ip="206.226.227.254"/>
            <filter src_ip="203.81.134.134" dst_ip="204.172.22.24"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.756630,2.563840,010,1 1 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.183.217.1" src_port="12200" dst_port="8118"/>
            <filter src_ip="1.183.217.1" src_port="12200" dst_port="3128"/>
            <filter src_ip="1.183.217.1" src_port="12200" dst_port="21320"/>
        </slice>
        <from usec="0" sec="1454389783"/>
        <to usec="0" sec="1454389853"/>
    </anomaly>
    <anomaly type="anomalous" value="7.072930,6.031960,503,1 1 1 1 1 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter src_ip="192.196.33.103" src_port="443"/>
            <filter dst_ip="202.34.56.9" src_port="443"/>
            <filter dst_ip="202.34.56.9" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.786670,2.582750,999,1 1 1 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.81.137.66" dst_port="53"/>
        </slice>
        <from usec="0" sec="1454389650"/>
        <to usec="0" sec="1454389696"/>
    </anomaly>
    <anomaly type="anomalous" value="5.586010,4.591290,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="61.210.90.22" dst_ip="131.230.209.213"/>
            <filter src_ip="61.210.90.22" src_port="80"/>
            <filter src_ip="202.175.31.145" dst_ip="131.230.209.213" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.488760,2.148990,011,1 1 1 1 0 0 0 0 0 1 1 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="222.181.70.138" src_port="2222" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.017720,2.010370,504,1 0 0 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="163.44.130.66" dst_port="443"/>
            <filter src_ip="133.152.188.17" dst_port="443"/>
            <filter dst_ip="108.64.80.130" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.077970,2.698360,503,0 0 0 1 1 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="45.48.211.199" src_port="80"/>
            <filter dst_ip="157.166.99.25" src_port="80"/>
        </slice>
        <from usec="0" sec="1454389201"/>
        <to usec="0" sec="1454389336"/>
    </anomaly>
    <anomaly type="anomalous" value="3.922610,2.930180,503,0 0 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="157.166.53.210"/>
            <filter src_port="80"/>
            <filter src_ip="40.175.152.97" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.232540,3.997130,504,0 0 0 1 0 1 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="202.34.181.70" dst_port="443"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389455"/>
    </anomaly>
    <anomaly type="anomalous" value="4.215960,4.001190,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389488"/>
    </anomaly>
    <anomaly type="anomalous" value="6.533830,5.855970,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="150.5.121.53" src_port="53"/>
            <filter dst_ip="163.44.214.167" src_port="53"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390028"/>
    </anomaly>
    <anomaly type="anomalous" value="2.013270,1.956760,503,1 0 0 1 0 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.154.146.118" src_port="80"/>
            <filter dst_ip="202.154.146.118" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.755030,2.219230,503,1 0 0 1 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="150.5.124.244" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.800940,2.587720,999,0 0 0 1 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.81.135.28" dst_port="53"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390001"/>
    </anomaly>
    <anomaly type="anomalous" value="2.800940,2.587720,999,0 0 0 1 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="150.5.121.53" src_port="53"/>
            <filter dst_ip="133.139.3.179" src_port="53"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389758"/>
    </anomaly>
    <anomaly type="anomalous" value="2.800940,2.587720,503,0 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="173.31.209.22" src_port="80"/>
            <filter dst_ip="157.166.99.18" src_port="80"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389571"/>
    </anomaly>
    <anomaly type="anomalous" value="3.061520,2.373470,503,0 0 0 1 1 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="117.101.226.157" src_port="80"/>
            <filter dst_ip="202.34.186.137" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.800940,2.587720,010,0 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.5.253.13" dst_port="54762"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="anomalous" value="2.782850,2.246880,503,0 0 0 1 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.44.226.174" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.775820,2.593990,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.5.252.240" dst_port="54770"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="anomalous" value="3.896240,2.964530,503,1 1 1 1 1 0 1 1 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.43.85.2" src_port="80"/>
            <filter dst_ip="202.43.85.2" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.775820,2.593990,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.67.194.131" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="anomalous" value="3.694870,2.801010,503,1 1 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter src_ip="31.242.234.72" src_port="443"/>
            <filter src_ip="31.242.234.115" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.775820,2.593990,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.5.252.136" dst_port="54762"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389876"/>
    </anomaly>
    <anomaly type="anomalous" value="2.775820,2.593990,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.132.66.117" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="anomalous" value="3.688390,2.806710,503,1 0 0 1 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="202.34.56.219" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.775820,2.593990,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.132.65.203" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1454389290"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="anomalous" value="1.978170,1.965040,503,1 0 0 0 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="96.145.148.248" src_port="80"/>
            <filter dst_ip="133.152.68.16" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.775820,2.593990,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.67.194.147" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="anomalous" value="2.775820,2.593990,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.132.66.51" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1454389290"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="anomalous" value="3.061520,2.373470,999,0 0 0 1 1 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.81.132.32" dst_port="32209"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="6.527730,5.853780,999,1 1 1 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="89.191.132.167" src_port="5109" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1454389784"/>
        <to usec="0" sec="1454390101"/>
    </anomaly>
    <anomaly type="anomalous" value="6.523100,5.858740,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="199.226.8.205" dst_ip="157.166.144.93" src_port="53"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389246"/>
    </anomaly>
    <anomaly type="anomalous" value="2.773300,2.563750,503,1 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="66.29.126.228" src_port="80"/>
            <filter dst_ip="157.166.99.66" src_port="80"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454390004"/>
    </anomaly>
    <anomaly type="anomalous" value="2.775820,2.593990,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="185.233.158.11" src_port="555" dst_port="123"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389246"/>
    </anomaly>
    <anomaly type="anomalous" value="2.775820,2.593990,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.132.65.186" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1454389290"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="anomalous" value="2.775820,2.593990,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.67.195.29" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1454389290"/>
        <to usec="0" sec="1454389606"/>
    </anomaly>
    <anomaly type="anomalous" value="2.775820,2.593990,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.67.195.13" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1454389200"/>
        <to usec="0" sec="1454389336"/>
    </anomaly>
    <anomaly type="anomalous" value="6.523100,5.858740,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="111.9.93.140" src_port="12200" dst_port="61111"/>
        </slice>
        <from usec="0" sec="1454389650"/>
        <to usec="0" sec="1454389696"/>
    </anomaly>
    <anomaly type="anomalous" value="3.470070,2.733770,503,1 1 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="96.145.148.247" src_port="80"/>
            <filter dst_ip="131.230.150.211" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.473880,2.757400,504,1 1 1 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="157.166.254.16" dst_port="443"/>
            <filter dst_ip="74.118.71.212" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.449830,2.739700,010,1 1 0 0 0 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="23.51.143.118" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.460460,2.156540,503,1 1 1 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="202.34.181.27" src_port="80"/>
            <filter src_ip="17.220.198.48" dst_ip="202.43.85.2" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.902930,2.909030,503,1 0 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="192.161.174.218" src_port="80"/>
            <filter dst_ip="150.5.49.114" src_port="80"/>
            <filter src_ip="192.216.35.0" dst_ip="133.139.32.156" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.449830,2.739700,503,1 1 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="203.122.86.230" dst_ip="163.44.97.20" src_port="80" dst_port="58929"/>
            <filter src_ip="203.122.86.230" dst_ip="163.44.97.20" src_port="80" dst_port="58928"/>
            <filter src_ip="203.122.86.230" dst_ip="150.5.51.222" src_port="80" dst_port="55567"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.442880,2.745530,999,1 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.81.132.32" src_port="32209"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.426380,2.133860,503,1 1 0 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="61.210.109.75" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.576500,4.574330,503,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="91.163.36.215" src_port="80"/>
            <filter dst_ip="131.230.242.59" dst_port="33435"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.031640,1.981590,010,1 1 1 0 0 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="182.212.160.167" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.445310,2.133740,503,1 0 0 1 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="96.145.148.235" src_port="80"/>
            <filter src_ip="109.57.255.58" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.463170,2.739610,503,1 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.44.47.32" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.549730,2.462410,503,0 0 0 1 0 0 0 0 0 0 0 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.44.13.45" src_port="80"/>
            <filter dst_ip="163.44.13.45" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.586010,4.591290,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="104.126.103.136" dst_ip="163.44.8.121"/>
            <filter src_ip="104.126.103.136" src_port="443"/>
            <filter src_ip="104.113.243.40" dst_ip="163.44.8.121" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.416490,2.141340,504,1 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="38.204.89.72" dst_ip="202.34.178.35" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.719090,4.614830,999,1 1 0 1 1 1 1 0 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="185.121.246.52" dst_port="53413"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.476600,2.162480,999,0 0 0 1 0 0 0 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.34.180.112" dst_port="6881"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.909060,2.903530,503,1 1 0 1 1 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.81.137.127" src_port="80"/>
            <filter dst_ip="203.81.137.127" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.591410,4.584950,503,1 1 1 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.81.134.127" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.448160,2.169980,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="203.81.132.121" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.476600,2.162480,504,0 0 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.44.128.36" src_port="443"/>
            <filter src_ip="64.46.108.186" dst_ip="163.44.128.36" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.476600,2.162480,503,0 0 0 1 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="61.210.75.42" dst_ip="163.44.72.28" src_port="80"/>
            <filter src_ip="61.210.75.42" dst_ip="163.44.99.66" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.448160,2.169980,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.44.13.45" src_port="80"/>
            <filter dst_ip="163.44.13.45" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.448160,2.169980,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="124.148.99.50" src_port="80"/>
            <filter dst_ip="202.34.183.170" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
