<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="2.642430,2.870160,504,1 1 1 0 0 0 1 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="202.22.227.5" dst_port="443"/>
            <filter src_ip="202.22.227.5" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.296000,3.023030,503,1 1 1 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="202.243.64.108" dst_port="80"/>
            <filter src_ip="202.243.64.108" dst_port="443"/>
            <filter dst_ip="202.248.240.207" dst_port="80"/>
        </slice>
        <from usec="0" sec="1467867600"/>
        <to usec="0" sec="1467868501"/>
    </anomaly>
    <anomaly type="suspicious" value="3.028540,3.354290,504,1 1 1 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="133.122.136.45" dst_port="443"/>
            <filter dst_ip="31.18.133.0" dst_port="443"/>
            <filter dst_ip="205.185.208.18" dst_port="443"/>
        </slice>
        <from usec="0" sec="1467867607"/>
        <to usec="0" sec="1467868490"/>
    </anomaly>
    <anomaly type="suspicious" value="2.647030,3.043390,504,1 0 0 0 0 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.353750,2.883390,504,1 1 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="3.011390,3.354930,504,1 1 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="202.243.176.49"/>
            <filter src_ip="198.220.156.184" src_port="443"/>
        </slice>
        <from usec="0" sec="1467867600"/>
        <to usec="0" sec="1467868349"/>
    </anomaly>
    <anomaly type="suspicious" value="2.715260,3.117380,504,1 1 1 0 0 0 1 0 1 1 0 0,ptmp">
        <slice>
            <filter src_ip="202.249.77.61" dst_port="53"/>
            <filter src_ip="202.249.77.61" dst_port="443"/>
            <filter src_ip="202.249.77.61" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.668470,3.127940,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.50.219.209" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.622750,2.870910,503,1 1 0 0 0 0 1 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="52.179.29.49" dst_ip="163.50.152.225" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.375650,2.882650,503,1 1 1 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="23.95.49.20" src_port="80"/>
            <filter dst_ip="202.249.77.72" dst_port="25"/>
            <filter dst_ip="163.50.13.89" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.353750,2.883390,504,1 1 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="202.243.173.200" src_port="443"/>
            <filter src_ip="178.0.210.248" dst_ip="202.243.173.200" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.375650,2.882650,503,1 1 1 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.50.39.147" src_port="80"/>
            <filter dst_ip="163.50.39.147" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="3.100900,3.254240,503,1 1 0 0 0 0 0 0 0 1 0 1,mptmp">
        <slice>
            <filter src_ip="124.87.53.60" src_port="80"/>
            <filter dst_ip="163.50.219.209" src_port="80"/>
            <filter dst_ip="163.50.152.102" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.375650,2.882650,504,1 1 1 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="157.35.254.217" dst_port="443"/>
            <filter src_ip="157.35.254.216" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.375650,2.882650,504,1 1 1 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="117.166.94.114" dst_ip="202.22.227.5" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.375650,2.882650,503,1 1 1 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="163.50.59.166" src_port="80"/>
            <filter src_ip="54.90.35.169" dst_ip="163.50.59.166" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.375650,2.882650,503,1 1 1 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.50.155.201" src_port="80"/>
            <filter dst_ip="163.50.155.201" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="3.011970,3.372470,504,1 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.122.158.163" dst_ip="54.186.226.45" dst_port="443"/>
            <filter src_ip="133.122.158.163" dst_ip="52.42.119.137" dst_port="443"/>
        </slice>
        <from usec="0" sec="1467867600"/>
        <to usec="0" sec="1467868251"/>
    </anomaly>
    <anomaly type="suspicious" value="3.011390,3.354930,504,1 1 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.22.227.5" src_port="443"/>
            <filter dst_ip="202.22.227.5" src_port="80"/>
        </slice>
        <from usec="0" sec="1467867603"/>
        <to usec="0" sec="1467868495"/>
    </anomaly>
    <anomaly type="suspicious" value="3.011970,3.372470,999,1 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="203.178.121.92" dst_ip="45.179.123.243" dst_port="3303"/>
            <filter src_ip="203.178.121.92" dst_ip="91.54.227.220" dst_port="3303"/>
        </slice>
        <from usec="0" sec="1467867632"/>
        <to usec="0" sec="1467868454"/>
    </anomaly>
    <anomaly type="suspicious" value="3.028540,3.354290,504,1 1 1 0 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="133.122.133.41" dst_port="443"/>
            <filter src_ip="133.122.133.41" dst_port="80"/>
        </slice>
        <from usec="0" sec="1467867609"/>
        <to usec="0" sec="1467868501"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.99.161.174" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1467867600"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.99.163.39" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.188.206.138" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1467867600"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="2.642430,2.870160,502,1 1 1 0 0 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="116.113.39.251" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.119.219" dst_port="53"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.99.163.123" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1467867600"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.188.136.183" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="3.533310,3.567470,503,0 0 0 0 0 0 1 1 1 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.178.113.194" dst_port="53"/>
            <filter dst_ip="203.178.113.194" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="203.178.118.7" src_port="53"/>
            <filter dst_ip="203.178.118.7"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.99.161.253" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1467867600"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.188.206.153" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1467867600"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.115.210" src_port="53"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="3.011390,3.354930,503,1 1 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_port="80"/>
            <filter dst_ip="31.18.137.7" dst_port="443"/>
        </slice>
        <from usec="0" sec="1467867600"/>
        <to usec="0" sec="1467868501"/>
    </anomaly>
    <anomaly type="suspicious" value="2.665860,3.023240,503,1 1 1 0 0 0 1 1 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="202.243.64.202" dst_port="443"/>
            <filter src_ip="202.243.64.202" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.115.211" src_port="53"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="1.863390,2.757810,010,1 1 1 0 0 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="121.67.174.73" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.178.121.30" dst_port="53"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467867736"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.50.223.228" src_port="53"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467867736"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="203.178.115.211" dst_ip="205.251.192.46" dst_port="53"/>
            <filter src_ip="203.178.115.210" dst_ip="205.251.192.46" dst_port="53"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467867871"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.119.222" dst_port="53"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467867736"/>
    </anomaly>
    <anomaly type="suspicious" value="3.011970,3.372470,503,1 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.243.64.108" src_port="80"/>
            <filter dst_ip="202.243.64.108" src_port="443"/>
        </slice>
        <from usec="0" sec="1467867643"/>
        <to usec="0" sec="1467868491"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.115.133" src_port="53"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467867736"/>
    </anomaly>
    <anomaly type="suspicious" value="2.597820,3.257760,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="17.106.216.46" src_port="16403" dst_port="16385"/>
            <filter dst_ip="17.106.216.46" src_port="16403" dst_port="16384"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.120.250" src_port="53"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467867871"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.243.191.241" src_port="53"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467867736"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.50.223.214" src_port="53"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467867736"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.119.221" dst_port="53"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.243.64.86" src_port="53"/>
            <filter dst_ip="202.243.64.86" dst_port="53"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467867736"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.188.207.99" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1467867600"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.188.207.113" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1467867600"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="17.106.216.47" src_port="16403" dst_port="16386"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="3.263290,3.567300,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.114.108" dst_port="51413"/>
        </slice>
        <from usec="0" sec="1467867690"/>
        <to usec="0" sec="1467868006"/>
    </anomaly>
    <anomaly type="suspicious" value="2.353750,2.883390,503,1 1 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="103.162.120.141" dst_ip="202.243.64.108" src_port="80"/>
            <filter src_ip="103.162.120.141" dst_ip="163.50.73.108" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.642430,2.870160,002,1 1 1 0 0 0 1 0 0 1 1 0,ntscUDP">
        <slice>
            <filter src_ip="112.3.185.5" src_port="52836" dst_port="137"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.354490,2.903780,504,1 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="202.243.70.187" dst_ip="108.167.171.7" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.375650,2.882650,999,1 1 1 0 0 0 0 0 0 1 1 0,ptpposcaUDP">
        <slice>
            <filter src_ip="8.151.240.247" dst_ip="202.243.190.171" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.353750,2.883390,503,1 1 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.243.169.175" src_port="80"/>
            <filter src_ip="8.151.240.247" dst_ip="202.243.169.175" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.375650,2.882650,503,1 1 1 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="163.50.4.186" dst_ip="91.206.196.62" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.354490,2.903780,503,1 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="163.50.59.192" dst_ip="54.185.237.174" dst_port="80"/>
            <filter src_ip="163.50.59.192" dst_ip="77.40.95.12" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.668470,3.127940,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="193.0.49.27" dst_ip="163.50.5.100" src_port="80" dst_port="55999"/>
            <filter src_ip="193.0.49.27" dst_ip="163.50.5.100" src_port="80" dst_port="55998"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.668470,3.127940,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYNt">
        <slice>
            <filter src_ip="61.255.11.248" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.668470,3.127940,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="65.194.204.204" dst_ip="163.50.154.182" src_port="443" dst_port="60858"/>
            <filter src_ip="65.194.204.204" dst_ip="163.50.154.182" src_port="443" dst_port="60857"/>
            <filter src_ip="65.194.204.204" dst_ip="163.50.154.182" src_port="443" dst_port="60856"/>
            <filter src_ip="65.194.204.204" dst_ip="163.50.154.182" src_port="443" dst_port="60855"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.668470,3.127940,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="91.45.231.226" dst_ip="163.50.154.198" src_port="443" dst_port="58576"/>
            <filter src_ip="91.45.231.226" dst_ip="163.50.154.198" src_port="443" dst_port="58560"/>
            <filter src_ip="91.45.231.226" dst_ip="163.50.154.198" src_port="443" dst_port="58558"/>
            <filter src_ip="91.45.231.226" dst_ip="163.50.154.198" src_port="443" dst_port="58556"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="3.101460,3.272310,503,1 0 0 0 0 0 0 0 0 1 0 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.50.153.61" src_port="443"/>
            <filter dst_ip="163.50.153.61" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.354490,2.903780,020,1 0 0 0 0 0 0 0 0 1 1 0,DDoSIC">
        <slice>
            <filter dst_ip="202.249.124.16" dst_port="33435"/>
            <filter dst_ip="202.249.124.16"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.375650,2.882650,503,1 1 1 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="202.39.151.234" dst_ip="202.249.77.99" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.622750,2.870910,504,1 1 0 0 0 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="202.22.227.5" src_port="443"/>
            <filter dst_ip="202.22.227.5" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.789960,3.272120,504,1 0 0 0 0 0 0 0 0 0 0 1,mptp">
        <slice>
            <filter dst_ip="163.50.18.145" src_port="443"/>
            <filter dst_ip="163.50.18.145" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.701400,3.846210,503,1 1 1 0 0 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="202.249.77.61" src_port="80"/>
            <filter dst_ip="202.249.77.61" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="7.304860,5.077060,999,1 1 1 1 1 1 1 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="103.50.145.103" dst_ip="203.178.119.242" dst_port="123"/>
            <filter src_ip="103.50.145.103" dst_ip="203.178.118.179" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.816810,3.338600,503,1 1 1 0 0 0 1 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="52.43.45.167" dst_ip="203.178.123.94" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.810180,3.447450,503,1 1 1 0 0 0 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.178.118.83" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="8.275370,5.686130,503,1 1 1 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="202.243.64.202" src_port="80"/>
            <filter dst_ip="202.243.64.202" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="7.313370,5.165140,010,1 1 1 1 1 1 1 1 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="104.124.146.136" src_port="45755" dst_port="2375"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.637220,3.349340,053,1 1 1 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="163.50.154.125" dst_port="23"/>
            <filter src_ip="23.80.144.1" dst_ip="163.50.154.125" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="7.453230,5.365630,503,1 1 1 1 1 1 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="52.43.45.167" dst_ip="203.178.123.94" dst_port="80"/>
        </slice>
        <from usec="0" sec="1467867600"/>
        <to usec="0" sec="1467868475"/>
    </anomaly>
    <anomaly type="anomalous" value="7.713910,5.362940,503,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="189.60.52.25" dst_port="53413"/>
            <filter src_ip="91.34.156.239" dst_port="23"/>
            <filter dst_ip="163.50.59.192" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.637220,3.349340,010,1 1 1 0 0 0 0 0 0 1 1 1,sntscSYNt">
        <slice>
            <filter src_ip="190.155.185.246" dst_port="23"/>
            <filter src_ip="14.235.197.121" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.637220,3.349340,504,1 1 1 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="202.243.173.200" dst_port="443"/>
            <filter src_ip="202.243.173.200" dst_ip="178.0.210.248" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="7.186810,5.165020,999,1 1 1 1 1 1 1 1 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="103.50.145.103" dst_ip="203.178.118.179" dst_port="123"/>
            <filter src_ip="103.50.145.103" dst_ip="203.178.119.242" dst_port="123"/>
        </slice>
        <from usec="0" sec="1467867600"/>
        <to usec="0" sec="1467868501"/>
    </anomaly>
    <anomaly type="anomalous" value="4.040660,3.811160,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1467867600"/>
        <to usec="0" sec="1467868338"/>
    </anomaly>
    <anomaly type="anomalous" value="7.800200,5.356230,504,1 1 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter src_ip="179.212.96.32" src_port="13291" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.803680,3.356860,503,1 0 0 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter src_ip="31.18.156.7" src_port="443"/>
            <filter src_ip="31.18.156.32" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.797020,3.465130,504,1 0 0 0 0 0 1 1 1 1 1 0,mptp">
        <slice>
            <filter dst_ip="202.249.113.133" src_port="53"/>
            <filter dst_ip="202.249.113.133" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="7.806830,5.355830,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="183.179.207.233" dst_port="3389"/>
            <filter src_ip="183.179.207.233" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.637220,3.349340,503,1 1 1 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="163.50.154.125" dst_ip="54.38.159.115" src_port="54236" dst_port="80"/>
            <filter src_ip="163.50.154.125" dst_ip="195.107.121.140" src_port="54358" dst_port="80"/>
            <filter src_ip="163.50.154.125" dst_ip="195.107.121.133" src_port="54407" dst_port="80"/>
            <filter src_ip="163.50.154.125" dst_ip="72.245.205.25" src_port="54250" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="7.800200,5.356230,503,1 1 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="120.145.158.246" src_port="80"/>
            <filter dst_ip="202.243.179.175" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="7.720620,5.362540,503,1 1 1 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.178.118.83" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="7.714130,5.373930,020,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.178.124.244" dst_ip="45.184.253.33"/>
            <filter dst_ip="69.64.198.240"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.623430,3.367550,504,1 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="163.50.83.162" dst_ip="54.37.105.110" src_port="57982" dst_port="443"/>
            <filter src_ip="163.50.83.162" dst_ip="54.37.105.110" src_port="57870" dst_port="443"/>
            <filter src_ip="163.50.83.162" dst_ip="17.13.8.147" src_port="123" dst_port="123"/>
            <filter src_ip="163.50.83.162" dst_ip="17.79.166.172" src_port="61723" dst_port="5223"/>
            <filter src_ip="163.50.83.162" dst_ip="178.0.99.245" src_port="59013" dst_port="5938"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.803680,3.356860,503,1 0 0 0 0 0 1 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="203.178.123.94" dst_ip="52.43.45.167" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.623430,3.367550,999,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter src_ip="45.184.253.33" dst_ip="203.178.124.244"/>
            <filter dst_ip="203.178.124.244" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.816810,3.338600,010,1 1 1 0 0 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="116.113.39.240" src_port="9090" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.623430,3.367550,020,1 0 0 0 0 0 0 0 0 1 1 1,DDoSIC">
        <slice>
            <filter dst_ip="203.178.113.138" dst_port="33435"/>
            <filter dst_ip="203.178.113.138"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.816810,3.338600,010,1 1 1 0 0 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="218.99.128.134" src_port="6000" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
