<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.254060,1.312140,010,1 1 1 0 0 0 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="182.214.80.228" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.495120,1.584440,999,1 1 1 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.9.122.0" dst_port="53"/>
        </slice>
        <from usec="0" sec="1473397206"/>
        <to usec="0" sec="1473398100"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254060,1.312140,999,1 1 1 0 0 0 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="206.45.228.130" dst_ip="203.5.137.56"/>
            <filter src_ip="204.253.206.158" dst_ip="203.5.137.56"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.145490,1.426390,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="120.18.28.122" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397789"/>
        <to usec="0" sec="1473397876"/>
    </anomaly>
    <anomaly type="suspicious" value="1.123660,1.255050,010,1 1 0 0 0 0 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="61.96.213.91" src_port="12200" dst_port="10200"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.001040,1.374060,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="190.68.57.126" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397200"/>
        <to usec="0" sec="1473397288"/>
    </anomaly>
    <anomaly type="suspicious" value="1.145490,1.426390,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="49.255.201.78" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397740"/>
        <to usec="0" sec="1473397786"/>
    </anomaly>
    <anomaly type="suspicious" value="1.145490,1.426390,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="61.96.208.120" dst_port="8118"/>
            <filter src_port="12200" dst_port="8118"/>
            <filter src_ip="61.96.208.120" src_port="12200" dst_port="8080"/>
            <filter src_ip="61.96.208.120" src_port="12200" dst_port="21320"/>
        </slice>
        <from usec="0" sec="1473397920"/>
        <to usec="0" sec="1473398051"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254060,1.312140,502,1 1 1 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="91.97.103.154" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.364830,1.483680,010,0 0 0 1 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="122.2.18.115"/>
        </slice>
        <from usec="0" sec="1473397227"/>
        <to usec="0" sec="1473397240"/>
    </anomaly>
    <anomaly type="suspicious" value="1.258540,1.416460,503,1 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="131.129.216.187" dst_ip="151.153.39.121" dst_port="80"/>
        </slice>
        <from usec="0" sec="1473397232"/>
        <to usec="0" sec="1473397268"/>
    </anomaly>
    <anomaly type="suspicious" value="1.364830,1.483680,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="202.9.119.198"/>
        </slice>
        <from usec="0" sec="1473397258"/>
        <to usec="0" sec="1473397308"/>
    </anomaly>
    <anomaly type="suspicious" value="1.364830,1.483680,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="118.17.60.42"/>
        </slice>
        <from usec="0" sec="1473397259"/>
        <to usec="0" sec="1473397270"/>
    </anomaly>
    <anomaly type="suspicious" value="1.364830,1.483680,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1473397200"/>
        <to usec="0" sec="1473397938"/>
    </anomaly>
    <anomaly type="suspicious" value="1.364830,1.483680,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1473397200"/>
        <to usec="0" sec="1473398028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.580710,1.607260,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1473397200"/>
        <to usec="0" sec="1473397938"/>
    </anomaly>
    <anomaly type="suspicious" value="1.580710,1.607260,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1473397200"/>
        <to usec="0" sec="1473398028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.580710,1.607260,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1473397200"/>
        <to usec="0" sec="1473397938"/>
    </anomaly>
    <anomaly type="suspicious" value="1.580710,1.607260,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1473397200"/>
        <to usec="0" sec="1473398028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059740,1.441940,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.55.161.102"/>
        </slice>
        <from usec="0" sec="1473397200"/>
        <to usec="0" sec="1473397246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059740,1.441940,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.196.42.108"/>
        </slice>
        <from usec="0" sec="1473397335"/>
        <to usec="0" sec="1473397381"/>
    </anomaly>
    <anomaly type="suspicious" value="1.059740,1.441940,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="164.124.232.214"/>
        </slice>
        <from usec="0" sec="1473397335"/>
        <to usec="0" sec="1473397381"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.9.96.60" src_port="53"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.95.79.206" dst_port="53"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,020,0 0 0 0 0 0 1 1 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="163.95.5.252"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,999,0 0 0 0 0 0 1 1 0 0 0 0,rflatDNS">
        <slice>
            <filter dst_ip="202.6.245.220" src_port="53"/>
            <filter src_ip="39.145.169.115" dst_ip="202.6.245.220" dst_port="53"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.329460,1.536270,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.5.136.34" dst_port="53"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397644"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.55.194.213" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.95.32.38" src_port="53"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.55.194.205" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.218.254.9" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.5.136.59" src_port="53"/>
            <filter dst_ip="203.5.136.59" dst_port="53"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.218.254.66" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.55.160.98" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1473397200"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.55.160.113" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.5.142.170" src_port="53"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.5.156.252" src_port="53"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.551820,1.588830,999,0 0 0 0 0 0 1 1 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.5.143.217" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.55.195.25" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.55.195.14" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.218.253.245" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="45.54.154.193" dst_ip="203.5.130.220" dst_port="161"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.5.141.195" dst_port="53"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.218.253.174" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1473397200"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.5.142.245" src_port="53"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430490,1.598460,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.5.142.244" src_port="53"/>
        </slice>
        <from usec="0" sec="1473397290"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.551820,1.588830,010,0 0 0 0 0 0 1 1 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="150.55.161.113" dst_port="54756"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.051070,1.253550,503,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="163.95.11.224" dst_ip="207.209.62.90"/>
            <filter src_ip="163.95.11.224" dst_ip="157.240.233.230"/>
            <filter src_ip="163.95.11.224" dst_ip="157.240.233.35"/>
            <filter src_ip="163.95.11.224" dst_ip="157.240.233.214"/>
            <filter src_ip="163.95.11.224" src_port="80"/>
            <filter src_ip="163.95.11.224" src_port="443"/>
            <filter dst_ip="207.209.62.90" src_port="80"/>
            <filter dst_ip="157.240.233.230" src_port="80"/>
            <filter dst_ip="157.240.233.35" src_port="80"/>
            <filter dst_ip="157.240.233.214" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.051070,1.253550,504,1 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="163.95.127.39" dst_ip="54.111.43.57" dst_port="443"/>
            <filter src_ip="163.95.127.39" dst_ip="54.103.232.220" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.051070,1.253550,503,1 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="202.43.64.223" dst_ip="163.95.220.113" dst_port="80"/>
            <filter src_ip="202.43.64.223" dst_ip="163.95.150.97" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.123660,1.255050,503,1 1 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="17.248.57.58" dst_port="443"/>
            <filter dst_ip="65.18.25.159" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.176250,1.329030,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="104.230.219.58" dst_ip="202.9.115.101" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.176250,1.329030,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="163.95.220.113" dst_ip="202.43.64.223" src_port="80"/>
            <filter src_ip="163.95.150.97" dst_ip="202.43.64.223" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.176250,1.329030,020,0 0 0 0 0 0 0 0 0 1 1 0,icmp_error">
        <slice>
            <filter src_ip="176.41.119.145"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.176250,1.329030,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="183.80.97.104" dst_ip="202.9.218.178" src_port="80" dst_port="52425"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.176250,1.329030,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYNt">
        <slice>
            <filter src_ip="190.73.129.169" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.176250,1.329030,999,0 0 0 0 0 0 0 0 0 1 1 0,ntscUDP">
        <slice>
            <filter src_ip="203.5.136.59" src_port="53"/>
            <filter src_ip="203.5.136.59" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.176250,1.329030,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="205.72.47.174" dst_ip="163.95.225.89" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.176250,1.329030,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYNt">
        <slice>
            <filter src_ip="27.28.198.95" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.176250,1.329030,503,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="61.83.242.213" dst_ip="163.95.225.242" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.176250,1.329030,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="66.30.66.93" dst_ip="163.95.125.204" src_port="80" dst_port="58272"/>
            <filter src_ip="66.30.66.93" dst_ip="163.95.125.204" src_port="80" dst_port="58271"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.176250,1.329030,504,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="163.95.126.36" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.145490,1.426390,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="89.91.140.237" src_port="5381" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1473397686"/>
        <to usec="0" sec="1473397910"/>
    </anomaly>
    <anomaly type="anomalous" value="2.497520,1.942250,504,1 1 1 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="202.6.202.60" dst_ip="204.172.50.40"/>
            <filter src_ip="202.6.202.60" dst_port="443"/>
            <filter dst_ip="204.172.50.40" dst_port="443"/>
            <filter dst_ip="204.172.50.40" dst_port="80"/>
        </slice>
        <from usec="0" sec="1473397200"/>
        <to usec="0" sec="1473398100"/>
    </anomaly>
    <anomaly type="anomalous" value="1.521490,1.331100,504,1 1 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="23.25.14.86" dst_ip="163.95.152.34" src_port="443" dst_port="50450"/>
            <filter src_ip="23.25.14.86" dst_ip="163.95.152.34" src_port="443" dst_port="50443"/>
            <filter src_ip="23.25.14.86" dst_ip="163.95.224.233" src_port="443" dst_port="52219"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.620180,1.385060,999,1 1 1 0 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.5.137.56" dst_ip="206.45.228.130"/>
            <filter src_ip="203.5.137.56" dst_ip="204.253.206.158"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.147750,2.177030,503,1 1 1 1 1 1 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.5.137.236" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.842300,2.001120,010,0 0 0 1 1 1 0 0 0 1 1 1,ptpDoSSYN">
        <slice>
            <filter src_ip="177.63.196.77" dst_ip="203.5.132.72" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.820940,1.952770,011,1 1 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="45.39.80.81" src_port="443" dst_port="19846"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.842300,2.001120,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="198.32.87.180" dst_ip="163.95.224.207" src_port="80" dst_port="59642"/>
            <filter src_ip="198.32.87.180" dst_ip="163.95.224.207" src_port="80" dst_port="59641"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.459380,1.953700,504,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="23.25.14.87" dst_ip="163.95.224.207" src_port="443" dst_port="59782"/>
            <filter src_ip="23.25.14.87" dst_ip="163.95.224.207" src_port="443" dst_port="59770"/>
        </slice>
        <from usec="0" sec="1473397779"/>
        <to usec="0" sec="1473398025"/>
    </anomaly>
    <anomaly type="anomalous" value="1.521490,1.331100,504,1 1 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="203.5.135.31" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.792550,1.581560,502,1 1 1 0 0 0 1 1 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="91.97.103.154" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.521490,1.331100,504,1 1 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="210.175.230.31" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.792820,1.951800,504,1 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="204.172.50.49" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.072530,2.142230,503,1 0 0 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.9.223.116" src_port="80"/>
            <filter dst_ip="202.9.223.116" src_port="443"/>
            <filter dst_ip="202.9.223.236" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.875370,1.989940,503,1 1 1 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.5.137.236" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.468700,1.329680,504,1 0 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="163.95.39.12" src_port="44715"/>
            <filter src_ip="163.95.39.12" dst_port="80"/>
            <filter src_ip="163.95.39.12" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.820940,1.952770,504,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="202.9.115.181" dst_port="443"/>
            <filter dst_ip="31.239.70.213" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.560740,1.401070,504,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="17.145.247.218" dst_ip="163.95.126.135" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.326480,1.725480,504,1 1 0 1 0 0 1 1 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="202.6.202.60" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.468700,1.329680,503,1 0 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="163.95.136.241" dst_port="80"/>
            <filter src_ip="163.95.136.241" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.468700,1.329680,504,1 0 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="163.95.250.119" dst_port="80"/>
            <filter src_ip="163.95.250.119" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.020390,1.531090,999,1 1 1 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="123.144.67.143" dst_port="23"/>
            <filter src_ip="104.12.161.11" src_port="35410" dst_port="161"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.098110,2.143110,504,1 1 0 1 1 1 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.201.76.50" src_port="443"/>
            <filter dst_ip="202.201.76.50" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.560740,1.401070,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.95.136.241" src_port="80"/>
            <filter dst_ip="163.95.136.241" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.468700,1.329680,999,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="45.54.154.193" dst_ip="203.5.130.212"/>
            <filter src_ip="45.54.154.193" dst_port="3001"/>
            <filter dst_ip="203.5.130.212" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.019030,1.656080,504,0 0 0 0 0 0 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.9.115.181" src_port="80"/>
            <filter dst_ip="202.9.115.181" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.997510,2.064850,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="45.39.80.81" src_port="19846" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.560740,1.401070,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="163.95.184.136" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.352330,1.780020,010,0 0 0 1 0 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="52.45.206.23" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.147750,2.177030,010,1 1 1 1 1 1 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="101.13.107.249" dst_port="1433"/>
            <filter src_ip="115.2.3.62" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.560740,1.401070,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="157.1.24.8" dst_ip="163.95.226.101"/>
            <filter src_ip="157.1.24.8" src_port="80"/>
            <filter dst_ip="163.95.226.97" src_port="443"/>
            <filter dst_ip="163.95.226.97" src_port="80"/>
            <filter dst_ip="163.95.226.101" src_port="443"/>
            <filter dst_ip="163.95.226.101" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.792820,1.951800,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter src_ip="157.1.24.41" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.560740,1.401070,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.95.184.221" src_port="443"/>
            <filter dst_ip="163.95.184.221" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.560740,1.401070,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.95.149.158" src_port="443"/>
            <filter dst_ip="163.95.149.158" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.620180,1.385060,999,1 1 1 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="130.64.163.245" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.147750,2.177030,503,1 1 1 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.6.202.60" src_port="80"/>
            <filter dst_ip="202.6.202.60" src_port="53"/>
            <filter src_ip="118.87.17.176" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.560740,1.401070,999,0 0 0 0 0 0 0 0 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.5.152.137" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
