<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="80"/>
            <filter src_ip="203.177.71.192" dst_port="443"/>
        </slice>
        <from usec="0" sec="1478840402"/>
        <to usec="0" sec="1478841285"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254490,1.499320,999,1 1 1 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="210.45.127.252" dst_port="123"/>
            <filter dst_ip="203.177.77.72" dst_port="123"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478841301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.230370,1.508250,999,1 1 1 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.2.194.120" dst_port="25"/>
        </slice>
        <from usec="0" sec="1478840403"/>
        <to usec="0" sec="1478841164"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,504,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="133.159.3.66" dst_port="443"/>
            <filter src_ip="133.159.3.66" dst_port="80"/>
            <filter src_ip="133.159.80.85" dst_port="443"/>
        </slice>
        <from usec="0" sec="1478840484"/>
        <to usec="0" sec="1478841227"/>
    </anomaly>
    <anomaly type="suspicious" value="1.762410,1.786640,504,1 0 0 0 0 0 0 0 0 0 0 1,mptmp">
        <slice>
            <filter src_ip="163.37.34.90" dst_port="443"/>
            <filter src_ip="163.37.34.90" dst_port="80"/>
            <filter dst_ip="199.128.79.2" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129190,1.437850,504,1 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="157.44.65.176" dst_port="443"/>
            <filter src_ip="157.44.65.178" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.230370,1.508250,502,1 1 1 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="203.177.71.241"/>
            <filter src_ip="121.210.233.163" dst_port="22"/>
        </slice>
        <from usec="0" sec="1478840402"/>
        <to usec="0" sec="1478841183"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254490,1.499320,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.78.50.126" dst_port="53"/>
            <filter src_ip="133.159.25.143" dst_port="53"/>
            <filter src_ip="133.159.25.140" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840402"/>
        <to usec="0" sec="1478841301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254490,1.499320,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="163.37.33.209" dst_port="53"/>
            <filter src_ip="163.37.33.237" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840431"/>
        <to usec="0" sec="1478841301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="61.60.32.124" dst_ip="163.37.208.155" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840549"/>
        <to usec="0" sec="1478840564"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.109.6.7" dst_ip="203.177.71.227" src_port="25454" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840742"/>
        <to usec="0" sec="1478840747"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254490,1.499320,999,1 1 1 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.159.248.119" dst_port="25"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478841301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="153.31.194.118" dst_ip="202.2.194.78" src_port="42481" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840456"/>
        <to usec="0" sec="1478840459"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.139.169.27" dst_ip="222.248.228.37" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840420"/>
        <to usec="0" sec="1478841152"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="157.44.104.107" dst_ip="17.133.155.8" src_port="52410" dst_port="25"/>
            <filter src_ip="157.44.104.107" dst_ip="17.187.33.242" src_port="53757" dst_port="25"/>
        </slice>
        <from usec="0" sec="1478840676"/>
        <to usec="0" sec="1478840989"/>
    </anomaly>
    <anomaly type="suspicious" value="0.980556,1.405530,504,1 0 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="163.37.132.239" dst_port="443"/>
            <filter src_ip="163.37.132.239" dst_port="80"/>
            <filter src_ip="133.139.43.91" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.37.79.198" dst_port="25"/>
        </slice>
        <from usec="0" sec="1478840468"/>
        <to usec="0" sec="1478840740"/>
    </anomaly>
    <anomaly type="suspicious" value="1.230370,1.508250,503,1 1 1 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="172.191.28.105" dst_ip="163.37.233.214" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840505"/>
        <to usec="0" sec="1478840990"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="219.103.237.168" dst_ip="203.177.68.96" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478841073"/>
        <to usec="0" sec="1478841294"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="1.51.129.160" dst_ip="202.2.194.84" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478841179"/>
        <to usec="0" sec="1478841210"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="69.63.202.58" dst_ip="203.177.72.204" src_port="56535" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840558"/>
        <to usec="0" sec="1478840560"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="218.238.217.122" dst_ip="203.177.68.96" src_port="55036" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840864"/>
        <to usec="0" sec="1478841266"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254490,1.499320,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="79.13.71.107" dst_port="23"/>
        </slice>
        <from usec="0" sec="1478840805"/>
        <to usec="0" sec="1478840851"/>
    </anomaly>
    <anomaly type="suspicious" value="1.211610,1.445390,504,1 1 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="76.216.245.173" dst_ip="203.177.68.106" dst_port="443"/>
            <filter src_ip="206.5.62.113" dst_ip="203.177.68.106" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,502,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="193.204.195.248" dst_ip="203.177.64.186" src_port="47802" dst_port="22"/>
            <filter src_ip="193.204.195.248" dst_ip="203.177.64.187" src_port="41679" dst_port="22"/>
            <filter src_ip="193.204.195.248" dst_ip="203.177.64.189" src_port="44963" dst_port="22"/>
        </slice>
        <from usec="0" sec="1478840479"/>
        <to usec="0" sec="1478841262"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="157.78.186.248" dst_ip="163.37.38.27" src_port="56667" dst_port="80"/>
            <filter src_ip="157.78.186.248" dst_ip="163.37.38.27" src_port="56666" dst_port="80"/>
            <filter src_ip="157.78.186.248" dst_ip="163.37.38.27" src_port="42329" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840923"/>
        <to usec="0" sec="1478840947"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.37.79.200" dst_port="25"/>
        </slice>
        <from usec="0" sec="1478840464"/>
        <to usec="0" sec="1478841168"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.37.126.209" dst_ip="175.156.235.214" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840768"/>
        <to usec="0" sec="1478840778"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.37.125.19" dst_ip="52.209.194.106" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478841158"/>
        <to usec="0" sec="1478841166"/>
    </anomaly>
    <anomaly type="suspicious" value="0.967453,1.443770,503,1 1 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="202.3.105.18" dst_ip="163.37.223.212" src_port="80"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478841231"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="202.11.217.163" src_port="25"/>
            <filter src_ip="202.11.217.163" dst_ip="79.189.30.8" src_port="110"/>
        </slice>
        <from usec="0" sec="1478840455"/>
        <to usec="0" sec="1478841259"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="91.11.230.114" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840402"/>
        <to usec="0" sec="1478841263"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="91.11.230.111" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840555"/>
        <to usec="0" sec="1478840951"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.177.76.65" src_port="25"/>
            <filter dst_ip="203.177.76.65" dst_port="25"/>
            <filter dst_ip="203.177.76.65" dst_port="23"/>
        </slice>
        <from usec="0" sec="1478840806"/>
        <to usec="0" sec="1478841218"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="157.44.198.89" dst_ip="60.254.227.210" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840401"/>
        <to usec="0" sec="1478841161"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,502,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="213.40.221.120" dst_port="22"/>
            <filter src_ip="213.40.221.120" dst_ip="203.177.76.91" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840403"/>
        <to usec="0" sec="1478841119"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="200.12.32.180" dst_ip="203.177.66.211" src_port="37021" dst_port="80"/>
            <filter src_ip="200.12.32.180" dst_ip="203.177.66.211" src_port="37020" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840826"/>
        <to usec="0" sec="1478840847"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="111.252.138.161" src_port="12200" dst_port="3128"/>
            <filter src_ip="111.252.138.161" src_port="12200" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840967"/>
        <to usec="0" sec="1478841024"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254490,1.499320,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="121.82.83.207" src_port="3699" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1478840476"/>
        <to usec="0" sec="1478840851"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254490,1.499320,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="125.185.232.26" src_port="3244" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1478840985"/>
        <to usec="0" sec="1478841031"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="175.203.52.35" src_port="4105" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1478840490"/>
        <to usec="0" sec="1478840492"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="119.60.168.108" src_port="3959" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1478840804"/>
        <to usec="0" sec="1478840806"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,502,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="193.204.195.249" dst_ip="203.177.64.185" dst_port="161"/>
            <filter src_ip="193.204.195.249" dst_ip="203.177.64.189" dst_port="161"/>
            <filter src_ip="193.204.195.249"/>
        </slice>
        <from usec="0" sec="1478840476"/>
        <to usec="0" sec="1478840479"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.58.166.245" dst_port="23"/>
        </slice>
        <from usec="0" sec="1478840593"/>
        <to usec="0" sec="1478840613"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="133.159.123.252" dst_ip="63.26.251.71" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478841242"/>
        <to usec="0" sec="1478841244"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="221.122.125.242" dst_port="23"/>
        </slice>
        <from usec="0" sec="1478840642"/>
        <to usec="0" sec="1478840649"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,502,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="192.73.93.134" dst_ip="203.177.69.70" src_port="45151" dst_port="22"/>
        </slice>
        <from usec="0" sec="1478841009"/>
        <to usec="0" sec="1478841011"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="124.239.167.158" dst_port="23"/>
        </slice>
        <from usec="0" sec="1478840881"/>
        <to usec="0" sec="1478840894"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="122.9.211.105" src_port="31133" dst_port="23"/>
            <filter src_ip="122.9.211.105" src_port="31133" dst_port="2323"/>
        </slice>
        <from usec="0" sec="1478840473"/>
        <to usec="0" sec="1478841243"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,sptpDoSSYN">
        <slice>
            <filter src_ip="123.249.119.181" dst_ip="163.37.93.236" src_port="2532" dst_port="2323"/>
            <filter src_ip="123.249.119.181" dst_ip="163.37.93.236" src_port="2532" dst_port="23"/>
        </slice>
        <from usec="0" sec="1478841246"/>
        <to usec="0" sec="1478841248"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="122.244.20.225" dst_port="23"/>
        </slice>
        <from usec="0" sec="1478840639"/>
        <to usec="0" sec="1478840641"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.139.20.125" dst_port="25"/>
            <filter src_ip="133.139.20.125" dst_ip="17.230.223.211" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840545"/>
        <to usec="0" sec="1478840998"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,504,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.139.240.121" dst_ip="151.122.234.185" dst_port="80"/>
            <filter src_ip="133.139.240.121" dst_ip="125.4.106.163" dst_port="443"/>
        </slice>
        <from usec="0" sec="1478840545"/>
        <to usec="0" sec="1478841162"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="210.103.86.98" dst_ip="163.37.153.242" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840877"/>
        <to usec="0" sec="1478840879"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="138.122.235.152" dst_ip="163.37.233.134" src_port="23560" dst_port="80"/>
            <filter src_ip="138.122.235.152" dst_ip="163.37.233.134" src_port="10428" dst_port="80"/>
            <filter src_ip="138.122.235.152" dst_ip="163.37.233.134" src_port="8671" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840609"/>
        <to usec="0" sec="1478840615"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="66.35.210.24" dst_ip="203.177.72.204" src_port="38312" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840742"/>
        <to usec="0" sec="1478840744"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="163.37.125.238" dst_port="443"/>
            <filter src_ip="163.37.125.238" dst_ip="204.50.146.194" dst_port="80"/>
            <filter src_ip="163.37.125.238" dst_ip="212.54.110.61" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840533"/>
        <to usec="0" sec="1478840546"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="163.37.148.160" dst_ip="98.133.169.103" dst_port="80"/>
            <filter src_ip="163.37.148.160" dst_ip="98.132.51.112" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478841197"/>
        <to usec="0" sec="1478841263"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="202.11.221.50" dst_port="80"/>
            <filter dst_ip="157.243.34.107" dst_port="80"/>
            <filter src_ip="202.11.221.50" dst_ip="157.243.34.107" dst_port="443"/>
        </slice>
        <from usec="0" sec="1478840403"/>
        <to usec="0" sec="1478841301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,504,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.37.126.47" dst_port="443"/>
            <filter src_ip="163.37.126.47" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840410"/>
        <to usec="0" sec="1478841170"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430330,1.509800,503,1 1 1 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="145.69.202.221" dst_ip="163.37.186.224" src_port="80" dst_port="47456"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.139.158.162" dst_ip="17.172.153.177" dst_port="25"/>
        </slice>
        <from usec="0" sec="1478840676"/>
        <to usec="0" sec="1478841072"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="210.85.239.203" dst_ip="202.2.194.78" dst_port="80"/>
            <filter src_ip="210.85.239.203" dst_ip="202.2.194.84" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840579"/>
        <to usec="0" sec="1478840837"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="79.163.189.245" dst_port="22"/>
        </slice>
        <from usec="0" sec="1478840412"/>
        <to usec="0" sec="1478840430"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter dst_ip="203.177.77.72" src_port="65377"/>
            <filter dst_ip="203.177.77.72" src_port="49741"/>
            <filter dst_ip="203.177.77.72" src_port="35452"/>
            <filter dst_ip="203.177.77.72" src_port="23190"/>
            <filter dst_ip="203.177.76.114" src_port="65377"/>
            <filter dst_ip="203.177.76.114" src_port="49741"/>
            <filter dst_ip="203.177.76.114" src_port="35452"/>
            <filter dst_ip="203.177.76.114" src_port="23190"/>
            <filter src_ip="72.82.243.107" dst_ip="203.177.77.72" dst_port="123"/>
            <filter src_ip="72.82.243.107" dst_ip="203.177.76.114" dst_port="123"/>
            <filter src_ip="72.82.243.107" src_port="65377" dst_port="123"/>
            <filter src_ip="72.82.243.107" src_port="49741" dst_port="123"/>
            <filter src_ip="72.82.243.107" src_port="35452" dst_port="123"/>
            <filter src_ip="72.82.243.107" src_port="23190" dst_port="123"/>
        </slice>
        <from usec="0" sec="1478840481"/>
        <to usec="0" sec="1478841083"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="86.128.125.238" dst_port="22"/>
        </slice>
        <from usec="0" sec="1478840955"/>
        <to usec="0" sec="1478840977"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="126.119.57.17" dst_ip="202.2.194.84" dst_port="80"/>
            <filter src_ip="1.51.129.160" dst_ip="202.2.194.84" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840883"/>
        <to usec="0" sec="1478841210"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="157.44.19.120" dst_ip="125.228.110.32" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840403"/>
        <to usec="0" sec="1478841236"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.159.249.120" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840432"/>
        <to usec="0" sec="1478841230"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="52.127.112.159" dst_ip="163.37.19.107" src_port="38534" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840673"/>
        <to usec="0" sec="1478840675"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="172.130.40.168" dst_ip="203.177.66.211" src_port="38242" dst_port="80"/>
            <filter src_ip="172.130.40.168" dst_ip="203.177.66.211" src_port="38241" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478841012"/>
        <to usec="0" sec="1478841034"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="91.15.220.168" dst_port="22"/>
        </slice>
        <from usec="0" sec="1478841182"/>
        <to usec="0" sec="1478841190"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254490,1.499320,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="194.19.135.70" dst_port="22"/>
        </slice>
        <from usec="0" sec="1478841248"/>
        <to usec="0" sec="1478841301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430330,1.509800,503,1 1 1 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="202.11.221.3" dst_port="80"/>
            <filter src_ip="202.11.221.3" dst_ip="204.73.219.240" dst_port="443"/>
            <filter src_ip="202.11.221.3" dst_ip="13.108.197.247" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,504,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.177.79.241" dst_ip="17.172.150.11" dst_port="443"/>
        </slice>
        <from usec="0" sec="1478841087"/>
        <to usec="0" sec="1478841137"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.159.25.35" dst_ip="216.209.126.54" src_port="32823" dst_port="25"/>
        </slice>
        <from usec="0" sec="1478840620"/>
        <to usec="0" sec="1478840639"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="183.156.111.39" dst_port="23"/>
        </slice>
        <from usec="0" sec="1478841017"/>
        <to usec="0" sec="1478841028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.37.196.219" dst_port="80"/>
            <filter src_ip="163.37.196.219" dst_port="443"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478841301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.139.61.60" dst_port="25"/>
        </slice>
        <from usec="0" sec="1478840785"/>
        <to usec="0" sec="1478841234"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="76.66.77.133" src_port="5353" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840734"/>
        <to usec="0" sec="1478840767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="91.11.231.120" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840440"/>
        <to usec="0" sec="1478840601"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="108.112.209.56" dst_port="23"/>
        </slice>
        <from usec="0" sec="1478840799"/>
        <to usec="0" sec="1478840827"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="104.54.33.181"/>
        </slice>
        <from usec="0" sec="1478840992"/>
        <to usec="0" sec="1478840993"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="157.44.221.167" dst_ip="202.184.25.249" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840488"/>
        <to usec="0" sec="1478840509"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="131.113.198.194" dst_ip="14.113.28.173" dst_port="80"/>
            <filter src_ip="131.113.198.194" dst_ip="14.113.28.172" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840807"/>
        <to usec="0" sec="1478840812"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254490,1.499320,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.177.76.93" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840524"/>
        <to usec="0" sec="1478841017"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="23.114.169.50" src_port="5353" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840533"/>
        <to usec="0" sec="1478840570"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="179.157.128.42"/>
        </slice>
        <from usec="0" sec="1478840781"/>
        <to usec="0" sec="1478841037"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="104.39.219.120" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1478840588"/>
        <to usec="0" sec="1478840591"/>
    </anomaly>
    <anomaly type="suspicious" value="1.230370,1.508250,020,1 1 1 1 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="113.117.197.252"/>
        </slice>
        <from usec="0" sec="1478840422"/>
        <to usec="0" sec="1478841134"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="79.183.218.216" dst_port="23"/>
        </slice>
        <from usec="0" sec="1478840568"/>
        <to usec="0" sec="1478840583"/>
    </anomaly>
    <anomaly type="suspicious" value="1.147060,1.508410,999,0 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.177.73.124" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840861"/>
        <to usec="0" sec="1478841007"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.191.105.113" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1478840675"/>
        <to usec="0" sec="1478840677"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="202.233.240.65" dst_port="23"/>
        </slice>
        <from usec="0" sec="1478841218"/>
        <to usec="0" sec="1478841231"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,504,1 1 1 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="157.44.65.179" dst_port="443"/>
            <filter dst_ip="17.227.54.203" dst_port="443"/>
        </slice>
        <from usec="0" sec="1478840414"/>
        <to usec="0" sec="1478841275"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="194.11.153.20" dst_port="23"/>
        </slice>
        <from usec="0" sec="1478840516"/>
        <to usec="0" sec="1478840529"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="111.168.128.98" src_port="1433"/>
        </slice>
        <from usec="0" sec="1478841244"/>
        <to usec="0" sec="1478841248"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254490,1.499320,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.177.71.253" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840674"/>
        <to usec="0" sec="1478841301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="54.236.6.4" dst_ip="203.177.77.44" src_port="55551" dst_port="25"/>
        </slice>
        <from usec="0" sec="1478841021"/>
        <to usec="0" sec="1478841024"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="183.57.178.112" dst_ip="202.11.221.11" src_port="43630" dst_port="25"/>
        </slice>
        <from usec="0" sec="1478840725"/>
        <to usec="0" sec="1478840727"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.159.25.141" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840409"/>
        <to usec="0" sec="1478840988"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,999,1 1 1 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="133.139.59.150" dst_ip="17.172.153.176" src_port="51539" dst_port="25"/>
        </slice>
        <from usec="0" sec="1478841280"/>
        <to usec="0" sec="1478841282"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,502,1 1 1 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="192.73.93.192" dst_ip="203.177.69.69" src_port="37644" dst_port="22"/>
        </slice>
        <from usec="0" sec="1478841009"/>
        <to usec="0" sec="1478841011"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.37.19.101" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840571"/>
        <to usec="0" sec="1478841238"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="95.4.8.81" dst_port="22"/>
        </slice>
        <from usec="0" sec="1478841217"/>
        <to usec="0" sec="1478841248"/>
    </anomaly>
    <anomaly type="suspicious" value="1.430330,1.509800,999,1 1 1 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="103.49.139.181" dst_ip="203.177.74.89" dst_port="123"/>
            <filter src_ip="192.254.6.157" dst_ip="203.177.74.89" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,502,1 1 1 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="138.75.14.90" dst_port="22"/>
            <filter dst_ip="163.37.18.116" dst_port="22"/>
        </slice>
        <from usec="0" sec="1478840566"/>
        <to usec="0" sec="1478840990"/>
    </anomaly>
    <anomaly type="suspicious" value="1.147060,1.508410,999,0 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="122.70.57.50" dst_ip="163.37.79.200" src_port="1784" dst_port="25"/>
            <filter src_ip="203.183.206.166" dst_ip="163.37.79.200" src_port="41658" dst_port="25"/>
            <filter src_ip="54.236.6.31" dst_ip="163.37.79.200" src_port="50383" dst_port="25"/>
        </slice>
        <from usec="0" sec="1478840464"/>
        <to usec="0" sec="1478840467"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="163.37.124.31" src_port="443"/>
            <filter src_ip="175.156.235.214" dst_ip="163.37.124.31" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129190,1.437850,503,1 0 0 1 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="163.37.196.219" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.792470,1.800150,504,1 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="133.139.192.204" dst_port="443"/>
            <filter dst_ip="17.143.166.13" dst_port="993"/>
            <filter dst_ip="17.227.54.242" dst_port="443"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478841158"/>
    </anomaly>
    <anomaly type="suspicious" value="1.373800,1.529660,999,1 1 1 1 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.159.74.135" src_port="14082"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478841121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.373800,1.529660,504,1 1 1 1 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.177.73.24" dst_port="443"/>
        </slice>
        <from usec="0" sec="1478840426"/>
        <to usec="0" sec="1478841301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254490,1.499320,504,1 1 1 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.177.68.77" dst_port="53"/>
            <filter src_ip="203.177.68.77" dst_port="443"/>
        </slice>
        <from usec="0" sec="1478840418"/>
        <to usec="0" sec="1478841301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.373800,1.529660,999,1 1 1 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.159.25.140" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840408"/>
        <to usec="0" sec="1478841138"/>
    </anomaly>
    <anomaly type="suspicious" value="1.736340,1.800280,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840688"/>
    </anomaly>
    <anomaly type="suspicious" value="1.736340,1.800280,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840688"/>
    </anomaly>
    <anomaly type="suspicious" value="1.824400,1.825620,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="114.239.52.132" src_port="21661" dst_port="23"/>
            <filter src_ip="114.239.52.132" src_port="21661" dst_port="2323"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840508"/>
    </anomaly>
    <anomaly type="suspicious" value="1.824400,1.825620,504,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.139.200.84" dst_ip="17.228.19.157" src_port="33783" dst_port="443"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840506"/>
    </anomaly>
    <anomaly type="suspicious" value="1.824400,1.825620,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="94.74.73.242" src_port="21580" dst_port="23"/>
            <filter src_ip="94.74.73.242" src_port="21580" dst_port="2323"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840598"/>
    </anomaly>
    <anomaly type="suspicious" value="1.824400,1.825620,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="193.214.52.24" src_port="33002" dst_port="23"/>
            <filter src_ip="193.214.52.24" src_port="33002" dst_port="2323"/>
        </slice>
        <from usec="0" sec="1478840401"/>
        <to usec="0" sec="1478840596"/>
    </anomaly>
    <anomaly type="suspicious" value="1.824400,1.825620,504,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="185.166.220.135" dst_ip="202.2.241.164" src_port="443"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840868"/>
    </anomaly>
    <anomaly type="suspicious" value="1.824400,1.825620,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="119.255.124.153" src_port="28411" dst_port="23"/>
            <filter src_ip="119.255.124.153" src_port="28411" dst_port="2323"/>
        </slice>
        <from usec="0" sec="1478840407"/>
        <to usec="0" sec="1478840777"/>
    </anomaly>
    <anomaly type="suspicious" value="1.824400,1.825620,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="125.249.26.145" src_port="45444" dst_port="23"/>
            <filter src_ip="125.249.26.145" src_port="45444" dst_port="2323"/>
        </slice>
        <from usec="0" sec="1478840407"/>
        <to usec="0" sec="1478840868"/>
    </anomaly>
    <anomaly type="suspicious" value="1.824400,1.825620,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="222.158.43.156" dst_ip="163.37.137.162" src_port="80"/>
            <filter src_ip="222.158.43.156" dst_ip="163.37.137.162" src_port="443"/>
            <filter src_ip="222.158.43.156" dst_ip="202.157.77.252" src_port="80"/>
        </slice>
        <from usec="0" sec="1478840691"/>
        <to usec="0" sec="1478840863"/>
    </anomaly>
    <anomaly type="suspicious" value="1.395130,1.608660,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.177.76.93" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="suspicious" value="0.997951,1.434440,020,1 1 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="192.135.60.43"/>
        </slice>
        <from usec="0" sec="1478840515"/>
        <to usec="0" sec="1478840851"/>
    </anomaly>
    <anomaly type="suspicious" value="0.997951,1.434440,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="109.124.22.187" dst_port="23"/>
        </slice>
        <from usec="0" sec="1478841075"/>
        <to usec="0" sec="1478841121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.254490,1.499320,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.177.76.74" src_port="53"/>
            <filter src_ip="203.177.76.74" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840634"/>
        <to usec="0" sec="1478841301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.395130,1.608660,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.159.216.3" src_port="53"/>
        </slice>
        <from usec="0" sec="1478841075"/>
        <to usec="0" sec="1478841121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.395130,1.608660,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.190.91.112" src_port="44171"/>
        </slice>
        <from usec="0" sec="1478841075"/>
        <to usec="0" sec="1478841121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.395130,1.608660,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="107.108.73.21" dst_port="110"/>
        </slice>
        <from usec="0" sec="1478841075"/>
        <to usec="0" sec="1478841121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.353100,1.579690,010,1 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="173.217.174.25" dst_port="22"/>
        </slice>
        <from usec="0" sec="1478841119"/>
        <to usec="0" sec="1478841166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.395130,1.608660,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="45.182.213.55" dst_port="110"/>
        </slice>
        <from usec="0" sec="1478841255"/>
        <to usec="0" sec="1478841301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.339380,1.652710,020,0 0 0 0 0 0 0 0 1 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="203.177.75.158"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.295540,1.624520,999,1 0 0 0 0 0 0 0 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.177.76.93" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.770710,1.811870,010,0 0 0 0 0 0 0 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.180.178.198" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.339380,1.652710,010,0 0 0 0 0 0 0 0 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.180.179.70"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="109.79.43.219"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,504,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="117.145.148.72"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="123.7.183.66"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.468020,1.498680,011,1 1 0 1 0 0 1 0 0 1 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="218.91.30.149" src_port="9200"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.980556,1.405530,999,1 0 0 0 0 0 0 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.159.27.229" src_port="53"/>
            <filter src_ip="133.159.27.229" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="151.122.189.186"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,020,0 0 0 0 0 0 0 0 0 1 0 0,icmp_error">
        <slice>
            <filter src_ip="163.37.25.156"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="178.33.195.234"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155430,1.428480,503,1 0 0 0 0 0 1 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="182.41.209.191" dst_ip="202.11.221.50" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,010,0 0 0 0 0 0 0 0 0 1 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="183.36.195.224"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="199.221.55.4"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="209.166.193.123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="210.57.83.53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,504,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="210.9.103.229"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="217.110.208.172"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="218.144.104.86"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="218.13.162.60"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.980556,1.405530,010,1 0 0 0 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="220.140.112.91" src_port="62210" dst_port="23"/>
            <filter src_ip="220.140.112.91" src_port="62210" dst_port="2323"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="220.143.72.122"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,504,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="23.16.40.4"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="5.251.93.190"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="61.39.69.102"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="62.61.135.90"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.155430,1.428480,010,1 0 0 0 0 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="89.252.175.252" src_port="42915" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095550,1.477480,503,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.37.38.211" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840495"/>
        <to usec="0" sec="1478840929"/>
    </anomaly>
    <anomaly type="suspicious" value="0.980556,1.405530,504,1 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.37.197.10" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.179230,1.469620,504,0 0 0 1 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="163.37.254.9" src_port="80"/>
            <filter src_ip="202.174.88.140" dst_ip="163.37.254.9" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.980556,1.405530,503,1 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="163.37.223.130" dst_ip="175.156.235.214" dst_port="80"/>
            <filter src_ip="163.37.124.31" dst_ip="175.156.235.214" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,503,0 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="188.136.18.24"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129190,1.437850,504,1 0 0 1 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="163.37.241.208" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.980556,1.405530,504,1 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="199.128.79.97" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.980556,1.405530,010,1 0 0 0 0 0 0 0 0 1 0 0,sptpDoSSYN">
        <slice>
            <filter src_ip="220.6.228.4" dst_ip="203.177.78.12" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,502,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="213.40.221.120"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.211610,1.445390,504,1 1 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="163.37.197.52" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="63.79.156.231"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.350860,1.523240,504,1 0 0 0 0 0 0 0 0 0 1 0,salphfl">
        <slice>
            <filter src_ip="163.37.134.131" dst_ip="162.154.221.126" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037780,1.438020,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="203.129.199.254" dst_ip="202.11.221.214" src_port="80" dst_port="62233"/>
            <filter src_ip="203.129.199.254" dst_ip="202.11.221.214" src_port="80" dst_port="57907"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.980556,1.405530,999,1 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="163.37.3.7" dst_ip="104.112.246.128" dst_port="9418"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.350860,1.523240,504,1 0 0 0 0 0 0 0 0 0 1 0,mptp">
        <slice>
            <filter dst_ip="163.37.197.10" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.129190,1.437850,503,1 0 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.177.73.24" src_port="53"/>
            <filter dst_ip="203.177.73.24" src_port="443"/>
            <filter dst_ip="203.177.73.24" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.182670,2.336430,504,1 1 1 1 1 0 1 1 1 1 1 0,ntscACK">
        <slice>
            <filter src_ip="202.2.194.32" dst_port="53"/>
            <filter src_ip="202.2.194.32" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.622100,2.602310,503,1 1 1 1 1 0 1 1 1 1 1 1,ntscACK">
        <slice>
            <filter src_ip="203.177.71.215" dst_port="443"/>
            <filter src_ip="203.177.71.215" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.214980,2.345710,503,1 1 1 1 0 0 1 1 1 1 1 1,ntscACK">
        <slice>
            <filter src_ip="202.11.221.214" dst_port="443"/>
            <filter src_ip="202.11.221.214" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.622100,2.602310,504,1 1 1 1 1 0 1 1 1 1 1 1,ntscACK">
        <slice>
            <filter src_ip="202.11.221.50" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.107580,1.696380,503,1 1 1 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.925360,1.829590,054,1 0 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="17.144.34.146" dst_port="443"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478841300"/>
    </anomaly>
    <anomaly type="anomalous" value="1.965720,1.639310,503,1 1 0 1 0 0 1 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="52.204.243.81" dst_ip="203.177.68.96" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.634150,1.554610,503,1 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="65.164.33.27" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.348710,1.925120,504,1 1 1 1 1 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="202.3.244.147" dst_port="80"/>
            <filter dst_ip="162.154.221.126" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.165840,2.326040,010,1 1 1 0 0 0 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="221.62.212.150" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.707410,1.673140,010,1 1 1 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="91.15.221.103" dst_port="22"/>
        </slice>
        <from usec="0" sec="1478840495"/>
        <to usec="0" sec="1478841301"/>
    </anomaly>
    <anomaly type="anomalous" value="2.116080,1.886660,502,1 1 1 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="202.11.217.163"/>
            <filter src_ip="116.103.122.31" dst_port="22"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478841295"/>
    </anomaly>
    <anomaly type="anomalous" value="2.597110,2.008460,999,1 1 1 0 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.177.77.8" dst_ip="206.219.155.21"/>
            <filter src_ip="203.177.77.8" dst_ip="204.29.208.30"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.707410,1.673140,999,1 1 1 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="211.10.100.83" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1478840405"/>
        <to usec="0" sec="1478841214"/>
    </anomaly>
    <anomaly type="anomalous" value="1.937730,1.649480,011,1 1 1 0 0 0 0 0 0 1 1 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="221.62.212.150" src_port="3306" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.995920,1.858130,503,1 1 1 0 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="118.8.190.251" dst_ip="203.177.72.204" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840403"/>
        <to usec="0" sec="1478841288"/>
    </anomaly>
    <anomaly type="anomalous" value="2.116080,1.886660,503,1 1 1 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="212.130.203.251" dst_port="22"/>
            <filter dst_ip="202.11.217.184" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478841301"/>
    </anomaly>
    <anomaly type="anomalous" value="1.707410,1.673140,010,1 1 1 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="113.2.1.240" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1478841120"/>
        <to usec="0" sec="1478841166"/>
    </anomaly>
    <anomaly type="anomalous" value="2.338760,1.826810,999,1 1 1 0 0 0 1 1 0 1 1 0,ntscUDP">
        <slice>
            <filter src_ip="133.159.25.143" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.352500,3.292440,503,1 1 0 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="202.2.194.32" src_port="80"/>
            <filter dst_ip="202.2.194.32" src_port="443"/>
            <filter dst_ip="202.2.194.32" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.893610,3.057780,503,1 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="203.177.68.96" dst_ip="52.204.243.81" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.908410,3.072840,010,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="23"/>
            <filter src_ip="104.112.246.128" dst_ip="163.37.3.6"/>
            <filter src_ip="104.112.246.128" dst_ip="163.37.3.7"/>
            <filter dst_ip="163.37.3.6" src_port="9418"/>
            <filter dst_ip="163.37.3.7" src_port="9418"/>
            <filter src_ip="104.112.246.128" dst_ip="163.37.3.4" src_port="9418"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.374230,1.935960,010,1 1 1 1 0 0 1 1 1 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="192.242.98.164" dst_port="81"/>
            <filter src_ip="178.40.166.222" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.622100,2.602310,504,1 1 1 1 1 0 1 1 1 1 1 1,ntscACK">
        <slice>
            <filter src_ip="202.157.77.252" dst_port="443"/>
            <filter src_ip="202.157.77.252" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.214980,2.345710,010,1 1 1 1 0 0 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="95.230.86.110" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.076520,3.117530,503,1 1 1 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.177.77.168" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.575630,2.495960,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840688"/>
    </anomaly>
    <anomaly type="anomalous" value="2.575630,2.495960,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840688"/>
    </anomaly>
    <anomaly type="anomalous" value="3.068770,2.738520,504,0 0 0 0 1 1 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.159.85.7" dst_ip="31.194.167.200" dst_port="443"/>
            <filter src_ip="133.159.85.7" dst_ip="17.186.162.55" dst_port="443"/>
        </slice>
        <from usec="0" sec="1478840422"/>
        <to usec="0" sec="1478840775"/>
    </anomaly>
    <anomaly type="anomalous" value="3.100870,2.738430,504,1 0 0 1 1 1 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.159.91.99" dst_port="443"/>
        </slice>
        <from usec="0" sec="1478840477"/>
        <to usec="0" sec="1478840844"/>
    </anomaly>
    <anomaly type="anomalous" value="1.925360,1.829590,502,1 0 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="116.103.122.41" src_port="22"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478841114"/>
    </anomaly>
    <anomaly type="anomalous" value="1.842130,1.804300,503,1 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.157.77.252" src_port="80"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840513"/>
    </anomaly>
    <anomaly type="anomalous" value="1.653160,1.560900,999,1 1 1 1 0 0 1 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.2.225.159" src_port="53"/>
            <filter dst_ip="202.11.221.225" src_port="53"/>
            <filter src_ip="39.16.180.253" dst_ip="202.2.225.159" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.622100,2.602310,503,1 1 1 1 1 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.177.77.168" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.707410,1.673140,999,1 1 1 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.135.60.43" src_port="5197" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1478840566"/>
        <to usec="0" sec="1478840971"/>
    </anomaly>
    <anomaly type="anomalous" value="3.869020,2.992870,010,1 1 1 1 1 1 1 1 0 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="218.91.30.149" dst_port="9200"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.180.207.197" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840851"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.180.207.217" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840851"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.132.69.74" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840851"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.132.69.58" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840851"/>
    </anomaly>
    <anomaly type="anomalous" value="1.832360,1.604280,504,1 0 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="192.15.72.131" src_port="443"/>
            <filter src_ip="192.15.72.131" src_port="80"/>
            <filter dst_ip="202.11.218.69" src_port="443"/>
            <filter dst_ip="163.37.208.224" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.622100,2.602310,503,1 1 1 1 1 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="202.11.221.50" src_port="443"/>
            <filter dst_ip="202.11.221.50" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.863610,1.632820,504,0 0 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="202.11.221.182" src_port="443"/>
            <filter src_ip="157.243.34.107" dst_ip="202.11.221.50" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.116080,1.886660,010,1 1 1 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="111.168.128.98" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1478841237"/>
        <to usec="0" sec="1478841301"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="45.187.157.31" dst_ip="203.177.66.195" dst_port="161"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.842130,1.804300,999,1 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.177.75.3" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478841176"/>
    </anomaly>
    <anomaly type="anomalous" value="1.925360,1.829590,020,1 0 0 1 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="203.177.77.251"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840851"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.180.206.213" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="133.78.63.129" src_port="53"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="133.159.27.158" dst_ip="178.7.90.2" src_port="53"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.177.71.253" src_port="53"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="133.159.27.158" dst_ip="178.7.90.5" src_port="53"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.2.225.159" src_port="53"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="202.11.221.167" src_port="80"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="133.159.27.158" dst_ip="202.127.35.117" src_port="53"/>
            <filter src_ip="131.113.126.135" dst_ip="202.127.35.117" src_port="53"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.842130,1.804300,010,1 0 0 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="159.56.100.170" dst_port="110"/>
        </slice>
        <from usec="0" sec="1478841120"/>
        <to usec="0" sec="1478841301"/>
    </anomaly>
    <anomaly type="anomalous" value="2.651860,2.024190,010,1 1 1 0 0 0 1 1 1 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="180.178.241.144" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="163.37.25.156"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter dst_ip="203.177.77.39" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.132.70.74" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840851"/>
    </anomaly>
    <anomaly type="anomalous" value="1.992810,1.856300,999,1 0 1 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.177.76.74" src_port="53"/>
            <filter dst_ip="203.177.76.74" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478841194"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.177.76.79" dst_port="53"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="203.177.75.117"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840851"/>
    </anomaly>
    <anomaly type="anomalous" value="1.842130,1.804300,999,1 0 0 0 0 0 1 1 1 0 0 0,ptmpla">
        <slice>
            <filter src_ip="79.189.30.8" dst_ip="202.11.217.163" dst_port="110"/>
            <filter src_ip="79.189.30.8" dst_ip="202.11.218.170" dst_port="110"/>
            <filter src_ip="79.189.30.8" dst_ip="202.11.218.57" dst_port="110"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840582"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.180.206.197" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840851"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,503,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.177.77.223" dst_port="80"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="111.221.61.197" dst_port="443"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.37.33.237" src_port="53"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.37.33.209" src_port="53"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.11.221.225" src_port="53"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,503,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="182.41.215.56" dst_ip="163.37.219.30" src_port="80"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.177.73.124" src_port="53"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.873220,1.829720,503,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="182.41.215.56" dst_ip="163.37.128.9" src_port="80"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.868290,1.619360,999,1 1 0 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.37.234.244" dst_port="30303"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.782400,1.590740,999,1 1 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="163.37.3.4" dst_ip="104.112.246.128" dst_port="9418"/>
            <filter src_ip="163.37.3.6" dst_ip="104.112.246.128" dst_port="9418"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.908410,3.072840,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.37.186.199" src_port="443"/>
            <filter dst_ip="163.37.186.199" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.597110,2.008460,503,1 1 1 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="202.16.217.195" dst_ip="163.37.155.134" src_port="21804" dst_port="80"/>
            <filter src_ip="202.16.217.195" dst_ip="163.37.155.134" src_port="15851" dst_port="80"/>
            <filter src_ip="202.16.217.195" dst_ip="163.37.79.138" src_port="13034" dst_port="53"/>
            <filter src_ip="202.16.217.195" dst_ip="163.37.79.138" src_port="9772" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.782400,1.590740,999,1 1 0 0 0 0 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="60.249.58.169" dst_ip="203.177.77.8" dst_port="23"/>
            <filter dst_ip="203.177.77.8"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.634150,1.554610,503,1 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="222.159.65.137" dst_ip="203.177.68.96" src_port="53304" dst_port="80"/>
            <filter src_ip="222.159.65.137" dst_ip="203.177.68.96" src_port="53302" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.634150,1.554610,504,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="31.194.174.13" src_port="443"/>
            <filter dst_ip="163.37.208.124" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.908410,3.072840,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.37.248.153" src_port="443"/>
            <filter src_ip="31.194.174.2" dst_ip="202.11.221.50" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.955130,1.854660,504,0 0 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.2.246.131" src_port="443"/>
        </slice>
        <from usec="0" sec="1478840400"/>
        <to usec="0" sec="1478840508"/>
    </anomaly>
    <anomaly type="anomalous" value="2.058890,1.830870,503,1 0 0 0 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="202.16.110.89" dst_ip="202.11.221.50"/>
            <filter src_ip="202.16.110.89" src_port="80"/>
            <filter src_ip="202.16.110.89" src_port="443"/>
            <filter dst_ip="202.11.221.214" src_port="80"/>
            <filter dst_ip="202.11.221.50" src_port="80"/>
            <filter dst_ip="202.11.221.50" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.908410,3.072840,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="17.229.71.12" src_port="80"/>
            <filter dst_ip="163.37.124.194" src_port="80"/>
            <filter dst_ip="163.37.124.194" src_port="443"/>
            <filter dst_ip="163.37.124.223" src_port="80"/>
            <filter dst_ip="163.37.124.223" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.425490,1.967420,504,0 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="31.194.170.88" src_port="443"/>
            <filter dst_ip="163.37.196.38" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.937730,1.649480,503,1 1 1 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="163.37.197.120" dst_port="80"/>
            <filter src_ip="163.37.197.120" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.234350,2.756010,504,1 0 0 1 1 1 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="163.37.198.98" dst_ip="205.60.100.145"/>
            <filter src_ip="163.37.198.98" dst_port="443"/>
            <filter src_ip="163.37.198.98" dst_port="80"/>
            <filter dst_ip="205.60.100.145" dst_port="443"/>
            <filter dst_ip="205.60.100.145" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.379210,1.931310,503,1 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="118.248.177.196" dst_ip="203.177.68.96" src_port="50401" dst_port="80"/>
            <filter src_ip="118.248.177.196" dst_ip="203.177.68.96" src_port="50398" dst_port="80"/>
            <filter src_ip="118.248.177.196" dst_ip="203.177.68.96" src_port="50397" dst_port="80"/>
            <filter src_ip="118.248.177.196" dst_ip="203.177.68.96" src_port="49836" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.379210,1.931310,504,1 0 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="163.37.116.11" dst_port="443"/>
            <filter src_ip="163.37.116.11" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.379210,1.931310,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="199.128.79.2" src_port="443"/>
            <filter dst_ip="163.37.126.82" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.669110,1.584040,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="23.16.37.31" dst_ip="163.37.124.155" src_port="443"/>
            <filter src_ip="23.16.37.31" dst_ip="163.37.124.155" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.403360,1.955070,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="52.223.195.32" dst_ip="163.37.116.11" src_port="443" dst_port="55700"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.669110,1.584040,999,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="45.187.157.31" dst_port="3010"/>
            <filter dst_ip="203.177.66.203" dst_port="3010"/>
            <filter src_ip="45.187.157.31" dst_ip="203.177.66.203" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.403360,1.955070,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="91.125.72.148" dst_ip="163.37.248.243" src_port="80" dst_port="60056"/>
            <filter src_ip="91.125.72.148" dst_ip="163.37.248.243" src_port="80" dst_port="60054"/>
            <filter src_ip="91.125.72.148" dst_ip="163.37.248.243" src_port="80" dst_port="60052"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.403360,1.955070,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="175.156.235.214" dst_ip="163.37.223.130"/>
            <filter src_ip="175.156.235.214" src_port="80"/>
            <filter dst_ip="163.37.124.31" src_port="80"/>
            <filter dst_ip="163.37.124.31" src_port="443"/>
            <filter dst_ip="163.37.223.130" src_port="80"/>
            <filter dst_ip="163.37.223.130" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.403360,1.955070,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.37.127.191" src_port="80"/>
            <filter dst_ip="163.37.127.191" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.669110,1.584040,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.37.197.52" src_port="443"/>
            <filter dst_ip="163.37.197.52" src_port="27019" dst_port="52871"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.669110,1.584040,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.37.138.119" src_port="443"/>
            <filter dst_ip="163.37.138.119" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.403360,1.955070,999,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="203.177.66.203" dst_ip="45.187.157.31" src_port="3001"/>
            <filter src_ip="203.177.66.203" dst_ip="45.187.157.31" src_port="3010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.597110,2.008460,503,1 1 1 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="163.37.126.174" dst_ip="13.108.218.76" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.483370,1.960500,503,1 1 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="163.37.151.213" dst_ip="199.111.243.159" dst_port="80"/>
            <filter src_ip="163.37.151.213" dst_ip="192.168.195.174" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.403360,1.955070,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.37.197.120" src_port="80"/>
            <filter dst_ip="163.37.197.120" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.941280,3.068390,504,1 0 0 1 1 1 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.157.77.252" src_port="443"/>
            <filter dst_ip="202.157.77.252" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
