<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.186460,1.738110,504,1 1 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="52.1.134.154" dst_ip="163.45.116.88" src_port="443" dst_port="53537"/>
            <filter src_ip="52.1.134.154" dst_ip="163.45.116.88" src_port="443" dst_port="53429"/>
            <filter src_ip="52.1.134.154" dst_ip="163.45.116.88" src_port="443" dst_port="53427"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.554490,1.910670,999,1 1 1 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.64.108.233" src_port="56588" dst_port="53"/>
        </slice>
        <from usec="0" sec="1476075870"/>
        <to usec="0" sec="1476075916"/>
    </anomaly>
    <anomaly type="suspicious" value="1.390750,1.781460,999,1 1 1 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="203.65.127.64" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.186460,1.738110,999,1 1 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="222.73.150.168" dst_ip="203.65.116.142"/>
            <filter src_ip="222.73.150.168" dst_ip="203.65.117.10"/>
            <filter src_ip="222.73.150.168" dst_port="123"/>
            <filter dst_ip="203.65.116.142" dst_port="123"/>
            <filter dst_ip="203.65.117.10" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.186460,1.738110,999,1 1 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="203.65.117.62" dst_ip="104.16.196.72" src_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.365560,1.801720,503,1 0 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="163.45.27.95" dst_port="443"/>
            <filter dst_ip="91.4.190.9" dst_port="80"/>
        </slice>
        <from usec="0" sec="1476075695"/>
        <to usec="0" sec="1476076490"/>
    </anomaly>
    <anomaly type="suspicious" value="1.539000,1.900770,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.65.127.113"/>
        </slice>
        <from usec="0" sec="1476075607"/>
        <to usec="0" sec="1476075866"/>
    </anomaly>
    <anomaly type="suspicious" value="1.539000,1.900770,504,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="8.239.54.56"/>
        </slice>
        <from usec="0" sec="1476075785"/>
        <to usec="0" sec="1476075847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.683960,1.846510,503,1 1 0 0 0 0 1 1 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="52.206.72.81" dst_ip="203.65.125.95" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.554490,1.910670,999,1 1 1 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.228.168.236" dst_port="53"/>
        </slice>
        <from usec="0" sec="1476075602"/>
        <to usec="0" sec="1476076463"/>
    </anomaly>
    <anomaly type="suspicious" value="1.374750,1.870320,999,1 1 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="133.172.117.250" dst_ip="186.79.4.155" src_port="25"/>
            <filter src_ip="133.172.117.253" dst_ip="186.79.4.155" src_port="25"/>
        </slice>
        <from usec="0" sec="1476075600"/>
        <to usec="0" sec="1476076485"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.233.134.241" dst_port="53"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476075736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.228.169.116" dst_port="53"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476075736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.228.169.115" src_port="53"/>
            <filter dst_ip="202.228.169.115" dst_port="53"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476075736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.228.174.110" dst_port="53"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476075736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,020,0 0 0 0 0 0 1 1 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="163.45.134.150"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476076366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.196.141.37" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476076366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.228.186.89" dst_port="53"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476075736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.45.168.169" src_port="53"/>
        </slice>
        <from usec="0" sec="1476075600"/>
        <to usec="0" sec="1476075736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.948470,2.000370,502,0 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="116.144.20.173" src_port="22"/>
        </slice>
        <from usec="0" sec="1476075612"/>
        <to usec="0" sec="1476076366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.196.141.54" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476075736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.187.94.182" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1476075600"/>
        <to usec="0" sec="1476076366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.554490,1.910670,999,1 1 1 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.65.117.53" src_port="53"/>
            <filter dst_ip="203.65.117.53" dst_port="53"/>
        </slice>
        <from usec="0" sec="1476075600"/>
        <to usec="0" sec="1476076366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.65.125.66" dst_port="53"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476075691"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.65.125.68" dst_port="53"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476075691"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.187.94.249" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1476075600"/>
        <to usec="0" sec="1476076366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.65.116.159" dst_port="53"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476075736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.196.255.69" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1476075600"/>
        <to usec="0" sec="1476076366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.196.255.86" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1476075600"/>
        <to usec="0" sec="1476076366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,020,0 0 0 0 0 0 1 1 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="203.65.115.137"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476076366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.196.140.166" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476075691"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,503,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="202.228.183.172" src_port="443"/>
            <filter src_ip="183.201.58.83" dst_ip="202.228.183.172" src_port="80"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476075736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.196.140.181" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476075691"/>
    </anomaly>
    <anomaly type="suspicious" value="1.814590,1.906510,020,1 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="202.228.59.94" src_port="53"/>
            <filter dst_ip="203.65.116.7"/>
            <filter dst_ip="203.65.116.7"/>
        </slice>
        <from usec="0" sec="1476075600"/>
        <to usec="0" sec="1476076366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.187.92.58" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1476075600"/>
        <to usec="0" sec="1476076366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.374750,1.870320,503,1 1 0 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="202.228.59.115" dst_ip="202.232.253.200"/>
            <filter src_ip="202.228.59.115" dst_port="80"/>
            <filter dst_ip="202.232.253.200" dst_port="80"/>
        </slice>
        <from usec="0" sec="1476075600"/>
        <to usec="0" sec="1476076500"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.196.254.198" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1476075600"/>
        <to usec="0" sec="1476076366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.196.254.213" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1476075600"/>
        <to usec="0" sec="1476076366"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.228.58.8" dst_port="53"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476075736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.420330,1.964050,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.228.58.1" dst_port="53"/>
        </slice>
        <from usec="0" sec="1476075645"/>
        <to usec="0" sec="1476075736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238990,1.838590,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="173.85.196.177"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.563550,1.770960,504,1 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="202.228.176.37" dst_ip="162.228.71.140" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238990,1.838590,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="203.124.40.188"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238990,1.838590,999,0 0 0 0 0 0 0 0 0 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="45.199.11.245"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238990,1.838590,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="103.105.72.162"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238990,1.838590,504,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="163.45.122.121" src_port="80"/>
            <filter src_ip="157.227.132.109" dst_ip="163.45.122.121" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.563550,1.770960,503,1 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.45.99.180" src_port="80"/>
            <filter dst_ip="163.45.99.180" src_port="443"/>
            <filter dst_ip="163.45.99.180" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.717110,1.871630,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="162.228.71.140" dst_ip="202.228.176.37" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.238990,1.838590,504,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="202.228.56.190" src_port="443"/>
            <filter src_ip="23.124.213.95" dst_ip="202.228.56.190" src_port="80"/>
            <filter src_ip="118.214.56.184" dst_ip="202.228.56.190" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.717110,1.871630,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="104.195.139.45" dst_ip="163.45.102.245" src_port="443" dst_port="61298"/>
            <filter src_ip="104.195.139.45" dst_ip="163.45.102.245" src_port="443" dst_port="61297"/>
            <filter src_ip="104.195.139.45" dst_ip="163.45.102.245" src_port="443" dst_port="61296"/>
            <filter src_ip="104.195.139.45" dst_ip="163.45.102.245" src_port="443" dst_port="61295"/>
            <filter src_ip="104.195.139.45" dst_ip="163.45.99.77" src_port="443" dst_port="53010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.717110,1.871630,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="157.227.132.68" dst_ip="163.45.192.238" src_port="80"/>
            <filter src_ip="157.227.132.68" dst_ip="163.45.195.242" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.717110,1.871630,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="203.124.40.189" dst_ip="202.228.182.205" src_port="80" dst_port="59652"/>
            <filter src_ip="203.124.40.189" dst_ip="202.228.182.205" src_port="80" dst_port="59616"/>
            <filter src_ip="203.124.40.189" dst_ip="202.228.182.205" src_port="80" dst_port="59615"/>
            <filter src_ip="203.124.40.189" dst_ip="202.228.182.184" src_port="80" dst_port="50440"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.717110,1.871630,010,0 0 0 0 0 0 0 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="94.153.172.84" src_port="48580"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.717110,1.871630,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="107.198.105.194" dst_ip="163.45.98.37" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.717110,1.871630,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.45.99.150" src_port="80"/>
            <filter dst_ip="163.45.99.150" src_port="443"/>
            <filter dst_ip="163.45.99.150" dst_port="20750"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.717110,1.871630,504,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="202.225.62.10" dst_ip="202.228.182.163" src_port="443"/>
            <filter src_ip="173.229.117.37" dst_ip="202.228.182.163" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.717110,1.871630,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.65.121.140" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.717110,1.871630,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.65.106.200" src_port="80"/>
            <filter dst_ip="203.65.106.200" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.504350,2.119810,999,1 1 1 0 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.65.116.247" dst_ip="206.220.236.0"/>
            <filter src_ip="203.65.116.247" dst_ip="204.194.237.225"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.786380,2.018870,999,1 1 1 1 1 1 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.64.108.235" src_port="55176" dst_port="123"/>
        </slice>
        <from usec="0" sec="1476075825"/>
        <to usec="0" sec="1476075871"/>
    </anomaly>
    <anomaly type="anomalous" value="2.438750,1.898520,504,1 1 1 1 1 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="52.211.239.219" dst_ip="163.45.116.88" src_port="443"/>
            <filter src_ip="184.74.14.105" dst_ip="163.45.116.88" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.944800,1.826650,504,1 1 1 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter src_ip="163.45.98.37" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.114960,2.082180,504,1 1 1 1 1 1 1 1 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="202.228.59.253" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.421930,2.259860,503,1 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.45.122.128" src_port="80"/>
            <filter dst_ip="163.45.122.128" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.421930,2.259860,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.65.116.72" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.535020,1.968620,999,1 0 0 1 1 1 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.65.127.79"/>
        </slice>
        <from usec="0" sec="1476075600"/>
        <to usec="0" sec="1476076128"/>
    </anomaly>
    <anomaly type="anomalous" value="2.619350,1.978870,503,1 0 0 1 1 1 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.228.59.115" src_port="80"/>
            <filter dst_ip="202.228.59.115" src_port="443"/>
        </slice>
        <from usec="0" sec="1476075600"/>
        <to usec="0" sec="1476076366"/>
    </anomaly>
    <anomaly type="anomalous" value="3.476500,2.261490,999,1 1 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.65.122.205" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.535020,1.968620,504,1 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="157.80.199.65" dst_port="443"/>
            <filter src_ip="157.80.255.7" dst_ip="17.178.130.120" dst_port="443"/>
        </slice>
        <from usec="0" sec="1476075605"/>
        <to usec="0" sec="1476076431"/>
    </anomaly>
    <anomaly type="anomalous" value="3.494770,2.339600,503,0 0 0 1 1 1 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="65.107.223.79" dst_ip="163.45.193.241" src_port="80"/>
            <filter src_ip="204.18.175.9" dst_ip="163.45.193.241" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.806400,2.038070,504,0 0 0 1 1 1 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="23.124.213.35" dst_ip="202.228.56.139" src_port="80" dst_port="37294"/>
            <filter src_ip="23.124.213.35" dst_ip="202.228.56.139" src_port="80" dst_port="35903"/>
            <filter src_ip="23.124.213.35" dst_ip="202.228.177.51" src_port="443" dst_port="56701"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.707250,2.008830,999,1 1 1 1 1 1 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="163.45.168.169" dst_port="53"/>
            <filter src_ip="163.45.168.154" dst_port="53"/>
        </slice>
        <from usec="0" sec="1476075606"/>
        <to usec="0" sec="1476076233"/>
    </anomaly>
    <anomaly type="anomalous" value="3.551410,2.294970,999,1 1 1 1 1 1 0 0 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="5.88.192.117" src_port="5225" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.747070,2.378130,503,1 1 1 1 1 1 1 1 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="203.65.117.53" src_port="53"/>
            <filter src_ip="203.65.117.53" dst_port="53"/>
            <filter src_ip="203.65.125.95" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.334120,2.111420,999,1 1 1 1 1 1 1 1 0 1 1 0,ntscUDP">
        <slice>
            <filter src_ip="209.41.198.50" src_port="5064" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.951210,1.996830,010,1 1 1 1 1 1 1 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_port="22"/>
            <filter src_ip="37.60.26.186" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="6.247560,5.168940,503,1 1 1 1 1 1 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.65.116.72" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.471100,5.110510,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.187.92.74" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1476075600"/>
        <to usec="0" sec="1476075691"/>
    </anomaly>
    <anomaly type="anomalous" value="3.494770,2.339600,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.45.97.66" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.421930,2.259860,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="80"/>
            <filter dst_ip="17.144.125.113" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.785190,1.779060,504,1 1 0 1 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="202.98.45.2" dst_port="443"/>
            <filter src_ip="202.98.45.2" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.964030,1.977270,999,1 0 0 1 1 1 0 0 0 1 1 0,ntscUDP">
        <slice>
            <filter src_ip="203.65.121.140" src_port="28179"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.829630,1.815540,504,1 1 1 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="203.65.113.248"/>
            <filter dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.967910,1.877460,999,1 0 0 0 0 0 1 1 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.65.127.79" dst_port="10572"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.676140,2.345830,503,1 1 0 1 1 1 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="202.228.59.253" src_port="80"/>
            <filter dst_ip="202.228.59.253" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.624590,2.344260,504,1 0 0 1 1 1 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.98.45.2" src_port="443"/>
            <filter dst_ip="202.98.45.2" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.944800,1.826650,010,1 1 1 0 0 0 1 0 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="222.214.134.117" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.476500,2.261490,504,1 1 0 1 1 1 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="163.45.116.88" dst_port="443"/>
            <filter src_ip="163.45.116.88" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.396930,2.083510,999,1 1 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter src_ip="45.200.101.31" dst_ip="203.65.122.205"/>
            <filter dst_ip="203.65.122.205" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.317080,2.081750,503,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="204.18.175.27" dst_ip="163.45.99.186"/>
            <filter src_ip="204.18.175.27" src_port="80"/>
            <filter src_ip="204.18.175.18" dst_ip="163.45.99.186"/>
            <filter src_ip="204.18.175.18" src_port="80"/>
            <filter dst_ip="163.45.99.186" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.612090,2.303770,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="117.176.129.50" src_port="10373" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.423360,2.168040,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.45.98.171" src_port="80"/>
            <filter src_ip="205.78.27.84" dst_ip="163.45.98.171" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.774840,2.209570,010,1 1 1 0 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="1433"/>
            <filter src_ip="188.178.62.109" src_port="5341" dst_port="5060"/>
            <filter src_ip="188.178.62.109" src_port="6254" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.693430,2.421220,503,0 0 0 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.228.178.212" src_port="80"/>
            <filter dst_ip="202.228.178.212" src_port="443"/>
            <filter dst_ip="163.45.61.142" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.423360,2.168040,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="183.201.58.83" dst_ip="202.228.187.6" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
