<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.463830,1.529410,503,1 1 1 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.83.124.97" src_port="80"/>
            <filter dst_ip="163.83.124.97" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.463830,1.529410,999,1 1 1 0 0 0 0 0 0 1 1 0,ntscUDP">
        <slice>
            <filter src_ip="222.50.191.254" dst_port="53413"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.153850,1.591440,999,1 1 1 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="14.204.66.67" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1462424587"/>
        <to usec="0" sec="1462424618"/>
    </anomaly>
    <anomaly type="suspicious" value="1.411200,1.574400,503,1 1 1 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="163.83.161.71"/>
            <filter src_ip="163.83.161.43"/>
            <filter dst_ip="91.227.147.255" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="126.248.152.80"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462424522"/>
    </anomaly>
    <anomaly type="suspicious" value="1.125910,1.619230,504,1 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.83.162.123" dst_ip="17.144.80.229" src_port="65358" dst_port="443"/>
            <filter src_ip="163.83.162.123" dst_ip="173.12.58.202" src_port="53439" dst_port="443"/>
            <filter src_ip="163.83.162.123" dst_ip="45.38.66.114" src_port="65364" dst_port="443"/>
            <filter src_ip="163.83.162.123" dst_ip="45.38.76.2" src_port="65398" dst_port="443"/>
            <filter src_ip="163.83.162.123" dst_ip="42.193.163.129" src_port="40394" dst_port="5222"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462425300"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,020,0 0 0 1 0 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="185.72.116.165"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462424598"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.215.34.160"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462424597"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="120.68.210.22"/>
        </slice>
        <from usec="0" sec="1462424401"/>
        <to usec="0" sec="1462424688"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="187.121.170.94"/>
        </slice>
        <from usec="0" sec="1462424401"/>
        <to usec="0" sec="1462424557"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="62.162.46.142"/>
        </slice>
        <from usec="0" sec="1462424414"/>
        <to usec="0" sec="1462424530"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.83.161.3"/>
        </slice>
        <from usec="0" sec="1462424437"/>
        <to usec="0" sec="1462424561"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="205.10.48.64"/>
        </slice>
        <from usec="0" sec="1462424492"/>
        <to usec="0" sec="1462424609"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,504,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="118.143.52.46"/>
        </slice>
        <from usec="0" sec="1462424554"/>
        <to usec="0" sec="1462424578"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,020,0 0 0 1 0 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="202.247.114.83"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462424688"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,502,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="202.252.236.46"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462424686"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="141.101.105.165"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462424673"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="163.83.5.104"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462424685"/>
    </anomaly>
    <anomaly type="suspicious" value="1.125910,1.619230,999,1 0 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="163.83.144.57" src_port="10810"/>
            <filter dst_ip="17.172.40.197" dst_port="993"/>
        </slice>
        <from usec="0" sec="1462424401"/>
        <to usec="0" sec="1462424985"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,010,0 0 0 1 0 0 0 0 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="218.54.91.183"/>
        </slice>
        <from usec="0" sec="1462424402"/>
        <to usec="0" sec="1462424688"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="31.211.42.15"/>
        </slice>
        <from usec="0" sec="1462424403"/>
        <to usec="0" sec="1462424661"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="203.14.124.24"/>
        </slice>
        <from usec="0" sec="1462424405"/>
        <to usec="0" sec="1462424685"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,504,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="210.167.14.218"/>
        </slice>
        <from usec="0" sec="1462424411"/>
        <to usec="0" sec="1462424671"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.215.170.78"/>
        </slice>
        <from usec="0" sec="1462424414"/>
        <to usec="0" sec="1462424663"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="173.12.42.50"/>
        </slice>
        <from usec="0" sec="1462424416"/>
        <to usec="0" sec="1462424682"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="219.150.206.79"/>
        </slice>
        <from usec="0" sec="1462424433"/>
        <to usec="0" sec="1462424687"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="60.64.190.46"/>
        </slice>
        <from usec="0" sec="1462424481"/>
        <to usec="0" sec="1462424574"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="183.234.122.230"/>
        </slice>
        <from usec="0" sec="1462424618"/>
        <to usec="0" sec="1462424628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="210.60.250.69"/>
        </slice>
        <from usec="0" sec="1462424401"/>
        <to usec="0" sec="1462424762"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="163.83.181.154" dst_port="80"/>
        </slice>
        <from usec="0" sec="1462424403"/>
        <to usec="0" sec="1462424776"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,502,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="203.14.124.234"/>
        </slice>
        <from usec="0" sec="1462424408"/>
        <to usec="0" sec="1462424778"/>
    </anomaly>
    <anomaly type="suspicious" value="1.388450,1.602490,999,1 0 0 1 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="133.215.66.241" dst_ip="81.170.35.209" dst_port="25"/>
            <filter src_ip="133.215.66.244" dst_ip="81.170.35.209" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,010,0 0 0 1 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="60.242.9.98"/>
        </slice>
        <from usec="0" sec="1462424713"/>
        <to usec="0" sec="1462424752"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.74.239.158"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462424958"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="37.114.20.109"/>
        </slice>
        <from usec="0" sec="1462424403"/>
        <to usec="0" sec="1462424956"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.203.53.74"/>
        </slice>
        <from usec="0" sec="1462424752"/>
        <to usec="0" sec="1462424840"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238660,1.689470,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="64.114.17.225"/>
        </slice>
        <from usec="0" sec="1462424401"/>
        <to usec="0" sec="1462425227"/>
    </anomaly>
    <anomaly type="suspicious" value="1.533910,1.812710,504,1 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.215.171.116" dst_ip="80.68.209.146" dst_port="443"/>
        </slice>
        <from usec="0" sec="1462424490"/>
        <to usec="0" sec="1462425211"/>
    </anomaly>
    <anomaly type="suspicious" value="1.839870,1.874430,020,1 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="203.14.120.59" src_port="53"/>
            <filter dst_ip="203.14.120.59" dst_port="53"/>
            <filter dst_ip="203.14.121.203"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462424776"/>
    </anomaly>
    <anomaly type="suspicious" value="1.533910,1.812710,010,1 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="80.81.77.200" src_port="55134"/>
        </slice>
        <from usec="0" sec="1462424541"/>
        <to usec="0" sec="1462425273"/>
    </anomaly>
    <anomaly type="suspicious" value="1.396540,1.719330,020,0 0 0 1 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="203.14.124.212"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462425211"/>
    </anomaly>
    <anomaly type="suspicious" value="1.533910,1.812710,999,1 0 0 0 0 0 1 1 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="203.14.117.177" dst_ip="217.95.55.86" dst_port="3303"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462425292"/>
    </anomaly>
    <anomaly type="suspicious" value="1.618480,1.875720,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.247.118.122" dst_port="53"/>
        </slice>
        <from usec="0" sec="1462424490"/>
        <to usec="0" sec="1462424536"/>
    </anomaly>
    <anomaly type="suspicious" value="1.618480,1.875720,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.252.95.249" dst_port="53"/>
        </slice>
        <from usec="0" sec="1462424490"/>
        <to usec="0" sec="1462424536"/>
    </anomaly>
    <anomaly type="suspicious" value="1.618480,1.875720,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.252.95.252" dst_port="53"/>
        </slice>
        <from usec="0" sec="1462424490"/>
        <to usec="0" sec="1462424536"/>
    </anomaly>
    <anomaly type="suspicious" value="1.618480,1.875720,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.14.120.36" dst_port="53"/>
        </slice>
        <from usec="0" sec="1462424490"/>
        <to usec="0" sec="1462424536"/>
    </anomaly>
    <anomaly type="suspicious" value="1.618480,1.875720,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.83.41.185" src_port="53"/>
        </slice>
        <from usec="0" sec="1462424490"/>
        <to usec="0" sec="1462424536"/>
    </anomaly>
    <anomaly type="suspicious" value="1.618480,1.875720,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.14.120.61" dst_port="53"/>
        </slice>
        <from usec="0" sec="1462424490"/>
        <to usec="0" sec="1462424716"/>
    </anomaly>
    <anomaly type="suspicious" value="1.618480,1.875720,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.14.119.182" dst_port="53"/>
        </slice>
        <from usec="0" sec="1462424490"/>
        <to usec="0" sec="1462424536"/>
    </anomaly>
    <anomaly type="suspicious" value="1.618480,1.875720,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.14.121.16" dst_port="53"/>
        </slice>
        <from usec="0" sec="1462424490"/>
        <to usec="0" sec="1462424536"/>
    </anomaly>
    <anomaly type="suspicious" value="1.618480,1.875720,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.243.179.74" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1462424490"/>
        <to usec="0" sec="1462424716"/>
    </anomaly>
    <anomaly type="suspicious" value="1.618480,1.875720,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.196.189.74" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462425211"/>
    </anomaly>
    <anomaly type="suspicious" value="1.618480,1.875720,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.14.113.8" dst_port="53"/>
        </slice>
        <from usec="0" sec="1462424490"/>
        <to usec="0" sec="1462424536"/>
    </anomaly>
    <anomaly type="suspicious" value="1.618480,1.875720,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="104.185.176.110" src_port="51284" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1462425165"/>
        <to usec="0" sec="1462425211"/>
    </anomaly>
    <anomaly type="suspicious" value="1.618480,1.875720,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.215.221.108" src_port="53"/>
        </slice>
        <from usec="0" sec="1462425165"/>
        <to usec="0" sec="1462425211"/>
    </anomaly>
    <anomaly type="suspicious" value="1.618480,1.875720,999,0 0 0 0 0 0 1 1 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.215.64.26" dst_ip="177.45.104.113" src_port="53"/>
            <filter src_ip="133.215.64.26" dst_ip="177.45.104.114" src_port="53"/>
        </slice>
        <from usec="0" sec="1462425165"/>
        <to usec="0" sec="1462425256"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,504,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="103.114.60.68"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,999,0 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="130.68.251.83"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,999,0 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="133.203.2.71"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,999,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="133.215.91.212"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.441900,1.558300,503,1 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="133.215.50.211" dst_ip="188.71.127.169" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,503,0 0 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="163.83.5.107"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,999,0 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="163.83.72.35"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,999,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="192.35.176.228"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,020,0 0 0 0 0 0 0 0 0 1 0 0,ttl_error">
        <slice>
            <filter src_ip="202.247.103.3"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,999,0 0 0 0 0 0 0 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.14.120.36" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,999,0 0 0 0 0 0 0 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.14.126.62" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,502,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="203.14.125.29" dst_ip="183.24.58.185" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,502,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="203.14.125.251" dst_ip="183.24.58.185" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,502,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="203.14.125.248"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,020,0 0 0 0 0 0 0 0 0 1 0 0,sptpDoSIC">
        <slice>
            <filter src_ip="217.48.76.92"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,999,0 0 0 0 0 0 0 0 0 1 0 0,salphfl">
        <slice>
            <filter src_ip="221.29.23.5"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="50.56.83.40"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="54.96.85.251"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="85.200.88.128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="85.181.244.135" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="111.177.214.60"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.256260,1.635420,010,0 0 0 0 0 0 1 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="180.100.155.74" dst_port="3128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.481340,1.673430,999,0 0 0 1 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.83.128.2" src_port="8333"/>
            <filter dst_ip="163.83.128.2" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.441900,1.558300,503,1 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.83.215.32" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,502,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="180.101.188.83"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.481340,1.673430,020,0 0 0 1 0 0 0 0 0 1 0 0,DDoSIC">
        <slice>
            <filter dst_ip="202.247.114.83" dst_port="33435"/>
            <filter dst_ip="202.247.114.83"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="203.150.183.145"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,010,0 0 0 0 0 0 0 0 0 1 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="203.14.125.118" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,502,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="222.122.106.50"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="68.112.51.86"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.078030,1.604000,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="72.183.191.170"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.531560,1.631170,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="133.215.91.171" dst_ip="73.61.82.188" src_port="1900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.463830,1.529410,503,1 1 1 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.83.162.64" src_port="80"/>
            <filter dst_ip="163.83.162.64" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.531560,1.631170,502,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="202.252.235.21" dst_ip="121.207.229.193" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.531560,1.631170,999,0 0 0 0 0 0 0 0 0 1 1 0,ntscUDP">
        <slice>
            <filter src_ip="203.14.120.59" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.531560,1.631170,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="52.172.75.36" dst_ip="163.83.160.1" src_port="443" dst_port="52860"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.463830,1.529410,503,1 1 1 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.246.3.109" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.531560,1.631170,502,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="183.24.58.190" dst_ip="133.74.230.121" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.531560,1.631170,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.83.126.132" src_port="443"/>
            <filter dst_ip="163.83.126.132" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.531560,1.631170,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="203.14.116.255" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.531560,1.631170,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="163.83.181.160" dst_ip="54.96.85.251" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.638840,2.734450,999,1 1 1 1 1 1 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.14.120.15" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.976950,1.667650,503,1 1 1 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="125.244.83.223" dst_ip="163.83.235.159"/>
            <filter src_ip="125.244.83.223" src_port="80"/>
            <filter dst_ip="163.83.235.159" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.976950,1.667650,503,1 1 1 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="163.83.154.245" src_port="443"/>
            <filter src_ip="23.228.95.144" dst_ip="163.83.154.245" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.079510,1.697890,010,1 1 1 0 0 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="120.230.161.9" dst_port="1433"/>
            <filter src_ip="119.178.124.22" dst_port="1433"/>
            <filter src_ip="188.3.177.35" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.222740,1.734540,503,1 1 1 1 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="163.83.124.244" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.472410,2.718330,504,1 1 1 1 1 1 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="203.14.112.112" src_port="28179"/>
            <filter src_ip="203.14.112.112" dst_ip="162.122.187.226" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.857100,1.850470,503,1 1 1 1 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.252.236.47" dst_port="80"/>
        </slice>
        <from usec="0" sec="1462424490"/>
        <to usec="0" sec="1462425297"/>
    </anomaly>
    <anomaly type="anomalous" value="2.656690,1.974890,503,1 1 1 1 0 0 1 1 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="52.74.116.69" dst_ip="203.14.119.175" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.976950,1.667650,503,1 1 1 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="203.14.121.243" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.976950,1.667650,999,1 1 1 0 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.14.121.119" dst_ip="206.194.16.222"/>
            <filter src_ip="203.14.121.119" dst_ip="204.51.209.61"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.123190,2.253390,503,1 1 1 1 1 0 1 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="133.215.170.110" dst_port="80"/>
            <filter src_ip="133.215.170.110" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.865620,2.829910,999,1 0 0 1 1 1 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="203.14.115.61" dst_port="8080"/>
            <filter dst_ip="203.14.115.61" dst_port="6881"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.873850,2.814110,504,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.83.162.109" src_port="443"/>
            <filter dst_ip="163.83.162.109" src_port="80"/>
            <filter dst_ip="163.83.127.93" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.435570,2.195830,020,0 0 0 1 1 0 0 0 0 0 0 0,sptpDoSIC">
        <slice>
            <filter src_ip="195.208.24.72" dst_ip="203.14.124.199"/>
        </slice>
        <from usec="0" sec="1462424410"/>
        <to usec="0" sec="1462424778"/>
    </anomaly>
    <anomaly type="anomalous" value="2.633680,2.516610,504,1 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="126.175.178.46" dst_ip="202.252.236.54" dst_port="443"/>
        </slice>
        <from usec="0" sec="1462424490"/>
        <to usec="0" sec="1462424536"/>
    </anomaly>
    <anomaly type="anomalous" value="2.454750,1.916410,503,1 1 1 0 0 0 1 1 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="203.14.119.175" dst_ip="199.198.52.27" src_port="80"/>
            <filter src_ip="203.14.119.175" dst_ip="52.74.116.69" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.659130,3.443570,503,1 1 1 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.14.121.177" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.633680,2.516610,999,1 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="202.247.103.201" src_port="53"/>
            <filter src_ip="202.247.103.201" dst_port="53"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462425263"/>
    </anomaly>
    <anomaly type="anomalous" value="2.973820,2.505610,010,1 1 1 0 0 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter src_ip="103.207.194.155" src_port="80"/>
            <filter src_ip="111.136.153.247" src_port="12200" dst_port="37015"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.895010,1.633540,502,1 1 1 1 0 0 1 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="183.24.58.185" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.645750,2.498820,010,1 1 1 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="111.136.159.127" src_port="12200" dst_port="8080"/>
            <filter src_ip="111.136.159.127" src_port="12200" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1462425144"/>
        <to usec="0" sec="1462425262"/>
    </anomaly>
    <anomaly type="anomalous" value="4.659130,3.443570,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="123.63.173.225" src_port="22201" dst_port="1723"/>
            <filter src_ip="123.63.173.225" src_port="22202" dst_port="1723"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.495730,1.998570,999,0 0 0 0 0 0 1 1 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.252.88.21" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.495730,1.998570,999,0 0 0 0 0 0 1 1 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.83.41.153" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.633680,2.516610,999,1 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="157.93.188.204" dst_ip="216.93.134.81" dst_port="53"/>
        </slice>
        <from usec="0" sec="1462424429"/>
        <to usec="0" sec="1462424536"/>
    </anomaly>
    <anomaly type="anomalous" value="2.683820,2.562370,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="157.93.188.140" dst_ip="208.146.1.81" dst_port="53"/>
            <filter src_ip="157.93.188.204" dst_ip="208.146.1.81" dst_port="53"/>
        </slice>
        <from usec="0" sec="1462424490"/>
        <to usec="0" sec="1462424536"/>
    </anomaly>
    <anomaly type="anomalous" value="2.683820,2.562370,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.196.191.189" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1462424490"/>
        <to usec="0" sec="1462425211"/>
    </anomaly>
    <anomaly type="anomalous" value="2.683820,2.562370,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.243.211.109" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462425211"/>
    </anomaly>
    <anomaly type="anomalous" value="2.683820,2.562370,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.243.210.213" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462424716"/>
    </anomaly>
    <anomaly type="anomalous" value="2.683820,2.562370,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.243.210.202" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462425211"/>
    </anomaly>
    <anomaly type="anomalous" value="2.683820,2.562370,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="208.157.196.203" src_port="44461"/>
        </slice>
        <from usec="0" sec="1462425165"/>
        <to usec="0" sec="1462425211"/>
    </anomaly>
    <anomaly type="anomalous" value="2.683820,2.562370,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.196.191.202" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462425211"/>
    </anomaly>
    <anomaly type="anomalous" value="2.683820,2.562370,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.243.211.125" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1462424400"/>
        <to usec="0" sec="1462425211"/>
    </anomaly>
    <anomaly type="anomalous" value="2.222740,1.734540,504,1 1 1 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="17.138.53.182" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.287290,1.866740,504,1 1 0 1 0 0 1 1 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="133.203.111.132"/>
            <filter dst_ip="31.211.35.253" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.960780,1.694190,503,1 0 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="163.83.124.7" dst_port="443"/>
            <filter src_ip="163.83.212.245" dst_ip="13.107.64.45" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.899950,2.870680,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.83.239.202" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.079510,1.697890,503,1 1 1 0 0 0 1 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="198.35.166.83"/>
            <filter src_ip="122.137.101.218" dst_port="53413"/>
            <filter src_ip="91.227.147.255" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.873850,2.814110,503,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter dst_port="53413"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.314430,1.763630,503,1 1 1 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter dst_port="80"/>
            <filter src_ip="202.247.75.195" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.045420,2.250590,503,1 0 0 1 1 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="163.83.124.244" dst_port="80"/>
            <filter src_ip="163.83.124.244" dst_ip="123.131.14.25" dst_port="8000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.112610,1.884760,010,0 0 0 0 0 0 1 1 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="133.196.189.5" dst_port="50356"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.866000,2.818810,504,1 1 0 1 1 1 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="202.252.77.12" dst_ip="38.108.70.76" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.927180,2.832130,503,1 1 1 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.14.121.177" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.027050,1.835840,502,1 1 1 1 0 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="95.110.147.141" src_port="22"/>
            <filter dst_ip="183.24.58.190" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.138130,2.968290,504,1 1 1 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter dst_ip="202.247.75.195" src_port="80"/>
            <filter dst_ip="202.247.75.195" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.767680,2.488000,010,1 1 1 0 0 0 1 1 1 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="61.228.222.112" src_port="12200" dst_port="10200"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.961530,1.675570,504,1 1 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="202.252.232.238" dst_port="443"/>
            <filter src_ip="133.215.180.139" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.208360,1.760070,999,1 0 0 1 0 0 0 0 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="133.215.64.104" src_port="53"/>
            <filter src_ip="133.215.64.104" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.027620,1.761440,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="163.83.158.46" dst_ip="91.189.38.8" src_port="123" dst_port="123"/>
            <filter src_ip="163.83.158.46" dst_ip="138.54.226.101" src_port="1797" dst_port="80"/>
            <filter src_ip="163.83.158.46" dst_ip="93.238.167.154" src_port="80" dst_port="54646"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.027620,1.761440,999,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="111.171.240.132" dst_ip="203.14.119.141" src_port="29033" dst_port="443"/>
            <filter src_ip="111.171.240.132" dst_ip="203.14.119.141" src_port="19875" dst_port="40001"/>
            <filter src_ip="111.171.240.132" dst_ip="203.14.119.141" src_port="17705" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.314430,1.763630,504,1 1 1 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="31.211.37.247" dst_port="443"/>
            <filter dst_ip="66.172.97.252" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.027620,1.761440,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.14.116.191" src_port="443"/>
            <filter dst_ip="203.14.116.191" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.960780,1.694190,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="199.47.217.149" src_port="443"/>
            <filter dst_ip="163.83.162.96" src_port="443"/>
            <filter dst_ip="163.83.162.96" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.027620,1.761440,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="202.24.243.17" dst_ip="202.252.232.112" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.027620,1.761440,502,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="203.14.120.34" dst_ip="1.254.36.36" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.027620,1.761440,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.83.161.206" src_port="80"/>
            <filter dst_ip="163.83.161.206" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.027620,1.761440,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="218.173.37.220" dst_ip="163.83.160.121" src_port="80" dst_port="49914"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.976950,1.667650,503,1 1 1 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.14.124.24"/>
            <filter src_ip="95.30.65.105" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.267920,1.824900,504,0 0 0 1 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="103.114.60.130" dst_ip="163.83.126.221" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.666610,2.792640,504,0 0 0 1 1 1 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.83.127.178" src_port="443"/>
            <filter dst_ip="163.83.127.178" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.112980,2.273100,504,1 0 0 1 1 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.83.240.97" src_port="80"/>
            <filter dst_ip="163.83.240.97" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.873850,2.814110,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="111.131.207.244" src_port="12200" dst_port="10020"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.027620,1.761440,503,0 0 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="133.215.65.80" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.222740,1.734540,504,1 1 1 1 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="163.83.126.217" dst_port="443"/>
            <filter src_ip="163.83.126.217" dst_port="80"/>
            <filter src_ip="163.83.162.96" dst_port="443"/>
            <filter src_ip="163.83.162.96" dst_port="80"/>
            <filter src_ip="133.215.7.228" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.659130,3.443570,010,1 1 1 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="195.101.252.67" src_port="48998"/>
            <filter src_ip="195.101.252.67" src_port="48999"/>
            <filter src_ip="195.101.252.67" dst_port="80"/>
            <filter src_ip="195.101.252.67" dst_port="443"/>
            <filter src_port="48998" dst_port="80"/>
            <filter src_port="48998" dst_port="443"/>
            <filter src_port="48999" dst_port="80"/>
            <filter src_port="48999" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.222740,1.734540,011,1 1 1 1 0 0 0 0 0 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="120.230.161.9" src_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
