<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.557490,2.246990,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.75.38.157" src_port="80"/>
            <filter src_ip="114.114.190.156" dst_ip="202.75.38.157" src_port="53"/>
        </slice>
        <from usec="0" sec="1470632490"/>
        <to usec="0" sec="1470632536"/>
    </anomaly>
    <anomaly type="suspicious" value="1.595430,2.031630,010,1 1 1 0 0 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.70.207.175" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.636930,1.919990,010,1 1 1 0 0 0 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="201.202.200.28" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.636930,1.919990,999,1 1 1 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="130.109.92.155" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.636930,1.919990,504,1 1 1 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="202.75.63.182" dst_ip="162.11.51.116" dst_port="443"/>
            <filter src_ip="202.75.63.182" dst_ip="205.58.138.247" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.590680,1.946320,504,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="133.24.43.224" dst_port="443"/>
            <filter dst_ip="54.214.241.206" dst_port="443"/>
            <filter src_ip="163.28.180.61" dst_ip="54.231.177.246" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.28.138.140" src_port="5223"/>
            <filter dst_ip="163.28.138.140" src_port="80"/>
        </slice>
        <from usec="0" sec="1470632490"/>
        <to usec="0" sec="1470632536"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,504,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.28.183.217"/>
        </slice>
        <from usec="0" sec="1470632490"/>
        <to usec="0" sec="1470632536"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="179.43.148.5" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1470632535"/>
        <to usec="0" sec="1470632581"/>
    </anomaly>
    <anomaly type="suspicious" value="1.923080,2.305900,999,1 1 1 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.24.216.158" dst_port="23"/>
            <filter dst_ip="212.25.89.147" dst_port="666"/>
            <filter src_ip="133.24.216.158" dst_ip="212.25.89.147" dst_port="5301"/>
            <filter src_ip="133.24.216.158" dst_ip="137.85.36.31" dst_port="666"/>
        </slice>
        <from usec="0" sec="1470632400"/>
        <to usec="0" sec="1470633300"/>
    </anomaly>
    <anomaly type="suspicious" value="1.883870,2.327870,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.181.107.194" dst_port="53"/>
        </slice>
        <from usec="0" sec="1470632490"/>
        <to usec="0" sec="1470633095"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.172.93.89" src_port="65535" dst_port="8545"/>
        </slice>
        <from usec="0" sec="1470633120"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,999,0 0 0 0 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="203.181.102.107" dst_ip="45.55.5.207" dst_port="3303"/>
        </slice>
        <from usec="0" sec="1470633120"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.51.244.73" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1470633120"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.75.34.240" src_port="53"/>
        </slice>
        <from usec="0" sec="1470633120"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.28.129.178" dst_port="53"/>
        </slice>
        <from usec="0" sec="1470633120"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.69.32.164" dst_port="53"/>
        </slice>
        <from usec="0" sec="1470633120"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.69.32.163" dst_port="53"/>
        </slice>
        <from usec="0" sec="1470633120"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.28.222.85" src_port="53"/>
        </slice>
        <from usec="0" sec="1470633120"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.28.222.105" src_port="53"/>
        </slice>
        <from usec="0" sec="1470633120"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.181.109.173" dst_port="53"/>
        </slice>
        <from usec="0" sec="1470633120"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.181.101.60" dst_port="53"/>
        </slice>
        <from usec="0" sec="1470633120"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.69.22.20" src_port="53"/>
        </slice>
        <from usec="0" sec="1470633120"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.181.105.122" src_port="53"/>
        </slice>
        <from usec="0" sec="1470633120"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.557490,2.246990,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.181.107.194" dst_port="53"/>
        </slice>
        <from usec="0" sec="1470633120"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.735100,2.384550,999,0 0 0 0 0 0 0 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="133.245.30.134" src_port="53"/>
            <filter dst_ip="133.245.30.134" dst_port="53"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="183.131.84.15" dst_ip="202.75.223.134" dst_port="53"/>
            <filter src_ip="122.135.237.182" dst_ip="202.75.223.134" dst_port="53"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,999,0 0 0 0 0 0 1 1 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="203.181.102.107" dst_ip="45.55.5.207" dst_port="3303"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="1.735100,2.384550,020,0 0 0 0 0 0 0 1 0 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="121.220.17.176"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,020,0 0 0 0 0 0 1 1 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="163.28.249.226"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.735100,2.384550,999,0 0 0 0 0 0 0 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.69.2.109"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.51.245.98" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.51.245.121" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.5.57.5" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1470632490"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.735100,2.384550,503,0 0 0 0 0 0 0 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.75.220.138" src_port="80"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="1.883870,2.327870,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.181.109.174" dst_port="53"/>
        </slice>
        <from usec="0" sec="1470632490"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.181.109.173" dst_port="53"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.181.101.60" dst_port="53"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="1.735100,2.384550,999,0 0 0 0 0 0 0 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.181.101.56"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.5.57.70" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1470632400"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.51.136.153" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1470632490"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="2.287810,2.449640,999,0 0 0 0 0 0 1 1 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="203.181.98.233" dst_port="1900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.51.136.137" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="2.287810,2.449640,999,0 0 0 0 0 0 1 1 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="133.24.228.157" dst_ip="62.209.194.101" src_port="25"/>
            <filter src_ip="133.24.228.155" dst_ip="62.209.194.101" src_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.735100,2.384550,999,0 0 0 0 0 0 0 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.181.104.118"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="1.735100,2.384550,503,0 0 0 0 0 0 0 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.181.104.68" src_port="80"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.51.244.73" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.5.59.158" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1470632400"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.5.59.198" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1470632490"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.51.137.1" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1470632490"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.51.137.21" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1470632400"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.735100,2.384550,999,0 0 0 0 0 0 0 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.69.25.249" src_port="53"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.181.103.5" src_port="53"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.75.34.240" src_port="53"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.28.222.85" src_port="53"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.28.222.105" src_port="53"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="1.883870,2.327870,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.181.109.170" dst_port="53"/>
        </slice>
        <from usec="0" sec="1470632490"/>
        <to usec="0" sec="1470633166"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.181.101.10" src_port="53"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="2.099130,2.473800,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.181.105.122" src_port="53"/>
        </slice>
        <from usec="0" sec="1470632625"/>
        <to usec="0" sec="1470632671"/>
    </anomaly>
    <anomaly type="suspicious" value="2.127430,2.279960,503,1 1 1 0 0 0 1 1 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="133.24.42.242" dst_port="80"/>
            <filter src_ip="133.24.42.242" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.590680,1.946320,504,1 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="162.11.51.116" dst_ip="202.75.63.182" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.092060,2.302180,504,1 0 0 0 0 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="163.28.180.150" dst_port="443"/>
            <filter src_ip="163.28.182.121" dst_port="443"/>
            <filter dst_ip="124.61.158.133"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.590680,1.946320,504,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="133.24.228.127" dst_ip="198.18.111.115" dst_port="443"/>
            <filter src_ip="203.181.105.102" dst_ip="172.145.50.204" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.590680,1.946320,504,1 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="133.245.20.144" src_port="443"/>
            <filter src_ip="8.22.236.8" dst_ip="133.245.20.144" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.287810,2.449640,010,0 0 0 0 0 0 1 1 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="150.51.244.94" dst_port="54748"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.590680,1.946320,503,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="157.207.39.142" src_port="80"/>
            <filter src_ip="202.75.217.2" dst_ip="31.70.81.246" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.590680,1.946320,503,1 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="163.28.43.60" dst_ip="173.3.198.39" src_port="51000" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.883870,2.327870,503,1 0 0 0 0 0 1 1 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="202.75.223.188" dst_ip="52.143.68.201" dst_port="80"/>
            <filter src_ip="202.75.223.188" dst_ip="52.19.66.254" dst_port="80"/>
            <filter src_ip="202.75.223.188" dst_ip="52.142.138.235" dst_port="80"/>
        </slice>
        <from usec="0" sec="1470632564"/>
        <to usec="0" sec="1470632992"/>
    </anomaly>
    <anomaly type="suspicious" value="1.840550,2.118690,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="133.24.138.215" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.840550,2.118690,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYNt">
        <slice>
            <filter src_ip="192.129.143.14" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.840550,2.118690,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYNt">
        <slice>
            <filter src_ip="196.153.77.42" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.840550,2.118690,020,0 0 0 0 0 0 0 0 0 1 1 0,ttl_error">
        <slice>
            <filter src_ip="203.181.106.30"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.840550,2.118690,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYNt">
        <slice>
            <filter src_ip="212.17.150.78" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.840550,2.118690,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYNt">
        <slice>
            <filter src_ip="217.240.108.170" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.840550,2.118690,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="23.250.127.19" dst_ip="202.75.56.57" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.840550,2.118690,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.28.101.253" src_port="80"/>
            <filter dst_ip="163.28.101.253" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.840550,2.118690,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYNt">
        <slice>
            <filter src_ip="80.149.154.245" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.840550,2.118690,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYNt">
        <slice>
            <filter src_ip="91.173.104.255" dst_port="8080"/>
            <filter src_ip="91.173.104.255" dst_port="3128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.840550,2.118690,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYNt">
        <slice>
            <filter src_ip="93.175.12.53" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.840550,2.118690,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="133.24.228.44" dst_ip="123.65.132.72" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.840550,2.118690,503,0 0 0 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="23.250.120.174" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.840550,2.118690,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.28.42.55" src_port="80"/>
            <filter dst_ip="163.28.42.55" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.840550,2.118690,020,0 0 0 0 0 0 0 0 0 1 1 0,icmp_error">
        <slice>
            <filter src_ip="133.8.209.69" dst_ip="182.63.89.149"/>
            <filter src_ip="133.8.209.68" dst_ip="182.63.89.149"/>
            <filter src_ip="133.8.209.65" dst_ip="182.63.89.149"/>
            <filter src_ip="203.181.108.242" dst_ip="182.63.89.149"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.018730,2.029760,010,1 1 1 0 0 0 1 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="161.234.106.154" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.288800,2.052020,504,1 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="133.8.186.218" dst_ip="107.231.23.55" src_port="63478" dst_port="443"/>
            <filter src_ip="133.8.186.218" dst_ip="107.231.23.55" src_port="61706" dst_port="443"/>
            <filter src_ip="157.181.253.93" dst_ip="107.231.23.55" src_port="43028" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.288800,2.052020,999,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="17.101.245.170" dst_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.460860,2.278290,504,1 1 1 0 0 0 1 1 0 1 1 0,mptmp">
        <slice>
            <filter dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.321180,2.027060,504,1 1 1 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="163.28.44.130" src_port="80"/>
            <filter src_ip="157.54.3.147" dst_ip="163.28.44.130" src_port="443"/>
            <filter src_ip="31.243.103.126" dst_ip="163.28.44.130" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.321180,2.027060,999,1 1 1 0 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.181.108.136" dst_ip="206.67.164.0"/>
            <filter src_ip="203.181.108.136" dst_ip="204.195.239.225"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.604540,2.131330,010,1 1 1 0 0 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="198.40.107.140" src_port="29811" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.699560,3.074360,504,1 1 1 1 1 1 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="203.181.97.237" src_port="28179"/>
            <filter src_ip="203.181.97.237" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.321180,2.027060,999,1 1 1 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.181.98.53" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.321180,2.027060,504,1 1 1 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter src_ip="133.24.234.176" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.699560,3.074360,999,1 1 1 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.181.98.53" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.845790,3.144090,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="58.69.43.233" src_port="9090" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.845790,3.144090,999,1 1 1 1 1 1 1 0 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="123.247.41.162" dst_port="1701"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.125520,3.025830,010,1 1 1 1 1 1 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.70.193.130" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1470632971"/>
        <to usec="0" sec="1470632976"/>
    </anomaly>
    <anomaly type="anomalous" value="4.699560,3.074360,999,1 1 1 1 1 1 0 0 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="104.0.185.231" src_port="38748" dst_port="9987"/>
            <filter src_ip="104.0.185.231" src_port="57832" dst_port="9987"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.345040,2.592920,503,1 1 1 1 0 0 1 1 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="202.69.61.143"/>
            <filter dst_port="443"/>
            <filter dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.482640,2.479520,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="104.150.125.100"/>
        </slice>
        <from usec="0" sec="1470632416"/>
        <to usec="0" sec="1470632455"/>
    </anomaly>
    <anomaly type="anomalous" value="5.046010,3.309980,503,1 1 1 1 1 1 1 1 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="52.137.48.70" dst_ip="203.181.101.47" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.434840,2.821790,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.28.78.33" dst_ip="110.173.12.138" dst_port="80"/>
        </slice>
        <from usec="0" sec="1470632400"/>
        <to usec="0" sec="1470632508"/>
    </anomaly>
    <anomaly type="anomalous" value="4.774310,3.202220,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="113.3.186.69" dst_ip="163.28.78.0" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.046010,3.309980,503,1 1 1 1 1 1 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.181.108.110" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.288800,2.052020,504,1 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="163.28.82.223" dst_ip="54.228.229.96" dst_port="443"/>
            <filter src_ip="163.28.180.225" dst_ip="54.228.229.96" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.683660,3.090870,503,1 0 0 1 1 1 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="202.75.223.27" dst_port="443"/>
            <filter src_ip="202.75.223.27" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.960440,2.369230,503,1 1 1 0 0 0 1 1 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="203.181.101.47" dst_ip="199.160.69.40" src_port="80"/>
            <filter src_ip="203.181.101.47" dst_ip="52.137.48.70" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.699560,3.074360,503,1 1 1 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.181.108.110" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.469010,2.216180,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="192.147.156.66" dst_ip="163.28.181.35" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.845790,3.144090,504,1 1 1 1 1 1 1 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="192.147.236.233" src_port="443"/>
            <filter src_ip="192.147.236.233" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.046010,3.309980,503,1 1 1 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.181.103.45" src_port="80"/>
            <filter src_ip="111.199.119.45" src_port="12200" dst_port="10200"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.469010,2.216180,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="118.167.11.69" dst_ip="163.28.42.111" src_port="443"/>
            <filter src_ip="118.167.11.69" dst_ip="163.28.42.111" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.288800,2.052020,503,1 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="163.28.101.108" dst_port="80"/>
            <filter src_ip="163.28.101.108" dst_ip="40.121.28.56" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.830360,3.160230,503,1 0 0 1 1 1 1 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="23.208.125.11" dst_ip="202.75.62.182" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.430340,2.300530,504,1 0 0 0 0 0 1 1 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.181.105.26" src_port="53"/>
            <filter dst_ip="203.181.105.26" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.046010,3.309980,010,1 1 1 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="37.56.176.76" src_port="80"/>
            <filter dst_ip="104.0.185.231"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.469010,2.216180,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="106.185.253.59" src_port="20162" dst_port="20162"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.469010,2.216180,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="124.61.158.133" src_port="20162" dst_port="20162"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.288800,2.052020,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter dst_ip="65.252.31.0" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.960440,2.369230,503,1 1 1 0 0 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="202.69.61.143" src_port="80"/>
            <filter dst_ip="202.69.61.143" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.845790,3.144090,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="219.255.109.8" dst_port="1433"/>
            <filter src_ip="186.118.223.166" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.430340,2.300530,020,1 0 0 0 0 0 1 1 0 1 1 0,icmp_error">
        <slice>
            <filter dst_ip="203.181.108.60" src_port="53"/>
            <filter dst_ip="203.181.108.60"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.469010,2.216180,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="23.250.120.14" dst_ip="163.28.183.6" src_port="443" dst_port="64996"/>
            <filter src_ip="23.250.120.14" dst_ip="163.28.183.6" src_port="443" dst_port="64995"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.686850,2.298150,503,1 0 0 0 0 0 0 1 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="52.143.68.201" dst_ip="202.75.223.188" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.469010,2.216180,010,0 0 0 0 0 0 0 0 0 1 1 1,sntscSYNt">
        <slice>
            <filter src_ip="41.40.205.213" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.288800,2.052020,503,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.181.127.158" src_port="80"/>
            <filter dst_ip="163.28.169.109" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.046010,3.309980,504,1 1 1 1 1 1 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.251.93.196" src_port="80"/>
            <filter dst_ip="202.251.93.196" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.031200,3.325320,504,1 0 0 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter dst_ip="202.75.63.251" src_port="80"/>
            <filter dst_ip="163.28.182.100" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.699560,3.074360,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="113.224.235.150" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.469010,2.216180,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.28.25.50" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.460860,2.278290,504,1 1 1 0 0 0 1 1 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="202.69.17.67" src_port="53"/>
            <filter dst_ip="202.69.17.67" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.774310,3.202220,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter dst_ip="163.28.39.158" src_port="80"/>
            <filter dst_ip="163.28.40.135" src_port="80"/>
            <filter dst_ip="202.75.51.133" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.321180,2.027060,010,1 1 1 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="23"/>
            <filter src_ip="17.2.152.20" src_port="443"/>
            <filter dst_ip="163.28.182.81" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.321180,2.027060,010,1 1 1 0 0 0 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="121.55.109.252" dst_port="23"/>
            <filter src_ip="121.172.157.165" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.604540,2.131330,010,1 1 1 0 0 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="190.67.4.205" dst_port="23"/>
            <filter src_ip="106.33.198.157" src_port="20388" dst_port="13128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
