<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="202.222.149.2" dst_ip="202.250.170.92" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481519524"/>
        <to usec="0" sec="1481519579"/>
    </anomaly>
    <anomaly type="suspicious" value="0.988268,1.478690,504,1 0 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="17.185.128.218" dst_port="443"/>
            <filter dst_ip="17.185.128.217" dst_port="443"/>
            <filter dst_ip="17.185.128.87" dst_port="443"/>
        </slice>
        <from usec="0" sec="1481518801"/>
        <to usec="0" sec="1481519701"/>
    </anomaly>
    <anomaly type="suspicious" value="0.988268,1.478690,999,1 0 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="17.186.48.103" dst_port="993"/>
            <filter src_ip="157.172.189.178" dst_ip="17.169.247.36" dst_port="443"/>
        </slice>
        <from usec="0" sec="1481518816"/>
        <to usec="0" sec="1481519693"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="130.186.179.10" dst_ip="17.169.9.23" src_port="2992" dst_port="53"/>
            <filter src_ip="130.186.179.10" dst_ip="17.158.240.178" src_port="35198" dst_port="25"/>
            <filter src_ip="130.186.179.10" dst_ip="17.158.240.182" src_port="35202" dst_port="25"/>
            <filter src_ip="130.186.179.10" dst_ip="17.139.66.112" src_port="58798" dst_port="25"/>
            <filter src_ip="130.186.179.10" dst_ip="17.233.246.36" src_port="60292" dst_port="53"/>
        </slice>
        <from usec="0" sec="1481518878"/>
        <to usec="0" sec="1481519209"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.202.44.7" dst_ip="17.158.240.179" src_port="58504" dst_port="25"/>
            <filter src_ip="133.202.44.7" dst_ip="17.158.240.183" src_port="57896" dst_port="25"/>
            <filter src_ip="133.202.44.7" dst_ip="17.139.66.119" src_port="44586" dst_port="25"/>
        </slice>
        <from usec="0" sec="1481519071"/>
        <to usec="0" sec="1481519431"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="133.223.25.254" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481519111"/>
        <to usec="0" sec="1481519365"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.223.25.255" dst_ip="23.217.81.29" dst_port="443"/>
            <filter src_ip="133.223.25.255" dst_ip="162.222.132.225" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481519482"/>
        <to usec="0" sec="1481519583"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="133.202.111.19" dst_ip="104.222.116.57" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481518871"/>
        <to usec="0" sec="1481519516"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.202.231.234" dst_ip="17.158.245.173" src_port="40352" dst_port="25"/>
            <filter src_ip="133.202.231.234" dst_ip="17.158.240.178" src_port="40267" dst_port="25"/>
            <filter src_ip="133.202.231.234" dst_ip="17.139.66.116" src_port="40348" dst_port="25"/>
            <filter src_ip="133.202.231.234" dst_ip="17.139.66.2" src_port="40287" dst_port="25"/>
        </slice>
        <from usec="0" sec="1481519145"/>
        <to usec="0" sec="1481519645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="130.186.161.232" dst_port="25"/>
        </slice>
        <from usec="0" sec="1481518825"/>
        <to usec="0" sec="1481519687"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.95.143.31" dst_port="25"/>
        </slice>
        <from usec="0" sec="1481518900"/>
        <to usec="0" sec="1481518947"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,504,1 1 1 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="203.95.130.52" src_port="20951"/>
            <filter src_ip="203.95.130.52" dst_port="443"/>
            <filter src_ip="203.95.130.52" dst_port="80"/>
            <filter dst_ip="151.101.73.26" dst_port="443"/>
        </slice>
        <from usec="0" sec="1481518936"/>
        <to usec="0" sec="1481519371"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.34.98.41" dst_ip="72.20.27.254" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481518891"/>
        <to usec="0" sec="1481519502"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="211.105.199.205" dst_ip="202.250.170.95" dst_port="80"/>
            <filter src_ip="211.105.199.205" dst_ip="202.250.170.92" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481519015"/>
        <to usec="0" sec="1481519226"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="72.178.142.37" dst_port="23"/>
        </slice>
        <from usec="0" sec="1481519284"/>
        <to usec="0" sec="1481519313"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,504,1 1 1 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="133.223.68.37" dst_ip="52.61.66.122" dst_port="443"/>
        </slice>
        <from usec="0" sec="1481518811"/>
        <to usec="0" sec="1481518889"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.223.94.37" dst_ip="31.13.50.43" src_port="43806" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481519682"/>
        <to usec="0" sec="1481519684"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.202.40.39" dst_port="25"/>
        </slice>
        <from usec="0" sec="1481519229"/>
        <to usec="0" sec="1481519491"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,504,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="157.172.255.72" dst_ip="211.104.9.32" dst_port="443"/>
        </slice>
        <from usec="0" sec="1481518805"/>
        <to usec="0" sec="1481519690"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.34.238.88" dst_ip="213.198.101.168" dst_port="25"/>
        </slice>
        <from usec="0" sec="1481519496"/>
        <to usec="0" sec="1481519500"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="49.98.110.91" dst_ip="202.244.75.247" src_port="21327" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481519379"/>
        <to usec="0" sec="1481519381"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="126.101.220.81" dst_ip="202.250.170.76" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481518869"/>
        <to usec="0" sec="1481518873"/>
    </anomaly>
    <anomaly type="suspicious" value="1.441510,1.564570,503,1 1 1 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="175.111.185.170" dst_ip="202.250.170.76" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481518917"/>
        <to usec="0" sec="1481519599"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="133.223.94.101" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481519021"/>
        <to usec="0" sec="1481519543"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,504,1 1 1 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter src_ip="133.223.234.96" dst_port="80"/>
            <filter dst_ip="94.206.99.29" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481518829"/>
        <to usec="0" sec="1481519699"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="202.244.77.135" src_port="25"/>
            <filter src_ip="202.244.77.135" dst_port="25"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519651"/>
    </anomaly>
    <anomaly type="suspicious" value="1.241630,1.531510,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.95.129.2" dst_port="53"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519602"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="133.223.70.235" dst_port="80"/>
            <filter src_ip="133.223.70.235" dst_port="443"/>
        </slice>
        <from usec="0" sec="1481519217"/>
        <to usec="0" sec="1481519654"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="1.75.238.232" dst_ip="202.244.77.150" src_port="31546" dst_port="80"/>
            <filter src_ip="1.75.238.232" dst_ip="202.244.77.150" src_port="31545" dst_port="80"/>
            <filter src_ip="1.75.238.232" dst_ip="202.244.77.150" src_port="31544" dst_port="80"/>
            <filter src_ip="1.75.238.232" dst_ip="202.244.77.150" src_port="31542" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481518843"/>
        <to usec="0" sec="1481518845"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="133.223.39.27" dst_ip="198.247.2.169" src_port="39640" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481518918"/>
        <to usec="0" sec="1481518923"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="202.215.208.225" dst_ip="163.34.123.19" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481519532"/>
        <to usec="0" sec="1481519535"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.223.65.96" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481518988"/>
        <to usec="0" sec="1481519655"/>
    </anomaly>
    <anomaly type="suspicious" value="1.555790,1.591240,999,1 1 1 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="99.70.213.206"/>
            <filter dst_port="25"/>
        </slice>
        <from usec="0" sec="1481518814"/>
        <to usec="0" sec="1481519497"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.202.78.135" dst_ip="17.158.240.182" src_port="40315" dst_port="25"/>
        </slice>
        <from usec="0" sec="1481518837"/>
        <to usec="0" sec="1481518840"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="61.135.158.143" dst_ip="202.11.97.13" dst_port="53"/>
            <filter src_ip="61.135.158.145" dst_ip="202.11.97.13" dst_port="53"/>
        </slice>
        <from usec="0" sec="1481518920"/>
        <to usec="0" sec="1481519680"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,502,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="193.60.126.136" dst_ip="203.95.137.160"/>
            <filter dst_ip="203.95.137.160" src_port="53"/>
            <filter dst_ip="203.95.137.160" dst_port="22"/>
        </slice>
        <from usec="0" sec="1481518847"/>
        <to usec="0" sec="1481519674"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,504,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.202.99.9" dst_port="443"/>
            <filter src_ip="133.202.99.9" dst_ip="151.101.78.166" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481518817"/>
        <to usec="0" sec="1481519615"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.91.48.17" dst_ip="202.250.170.76" src_port="62296" dst_port="80"/>
            <filter src_ip="203.91.48.17" dst_ip="202.250.170.76" src_port="62295" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481518925"/>
        <to usec="0" sec="1481518927"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,504,1 1 1 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="133.223.65.141" dst_ip="31.13.56.42" dst_port="443"/>
        </slice>
        <from usec="0" sec="1481518884"/>
        <to usec="0" sec="1481518906"/>
    </anomaly>
    <anomaly type="suspicious" value="1.454250,1.529840,999,1 1 1 0 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="203.95.129.82" dst_port="53"/>
            <filter src_ip="221.203.31.209" src_port="58063" dst_port="22"/>
            <filter src_ip="104.127.52.10" src_port="5161" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.46.35.99" dst_port="23"/>
        </slice>
        <from usec="0" sec="1481518877"/>
        <to usec="0" sec="1481518890"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="112.45.93.15" dst_port="23"/>
        </slice>
        <from usec="0" sec="1481518928"/>
        <to usec="0" sec="1481519359"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="62.215.150.236" dst_port="23"/>
        </slice>
        <from usec="0" sec="1481519078"/>
        <to usec="0" sec="1481519100"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.34.48.223" dst_port="80"/>
            <filter src_ip="163.34.48.223" dst_port="443"/>
            <filter src_ip="163.34.43.91" dst_port="80"/>
            <filter src_ip="163.34.43.91" dst_port="443"/>
        </slice>
        <from usec="0" sec="1481519189"/>
        <to usec="0" sec="1481519690"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.46.46.26" dst_port="23"/>
        </slice>
        <from usec="0" sec="1481518935"/>
        <to usec="0" sec="1481518947"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="222.143.138.242" dst_port="22"/>
        </slice>
        <from usec="0" sec="1481519045"/>
        <to usec="0" sec="1481519168"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="182.46.82.201" src_port="3083" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1481519106"/>
        <to usec="0" sec="1481519108"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="209.121.46.161" src_port="5587" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1481519274"/>
        <to usec="0" sec="1481519277"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="104.73.150.56"/>
        </slice>
        <from usec="0" sec="1481519235"/>
        <to usec="0" sec="1481519349"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.29.205.211" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1481519251"/>
        <to usec="0" sec="1481519255"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.47.166.52" dst_port="23"/>
        </slice>
        <from usec="0" sec="1481519046"/>
        <to usec="0" sec="1481519051"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.95.134.59" src_port="53"/>
            <filter src_ip="203.95.134.59" dst_port="53"/>
        </slice>
        <from usec="0" sec="1481518884"/>
        <to usec="0" sec="1481519569"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.47.230.60" dst_port="23"/>
        </slice>
        <from usec="0" sec="1481519364"/>
        <to usec="0" sec="1481519374"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="82.77.136.243" dst_port="666"/>
        </slice>
        <from usec="0" sec="1481519370"/>
        <to usec="0" sec="1481519381"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="124.136.187.222" dst_port="23"/>
        </slice>
        <from usec="0" sec="1481519092"/>
        <to usec="0" sec="1481519098"/>
    </anomaly>
    <anomaly type="suspicious" value="1.241630,1.531510,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="111.177.64.67" dst_port="5901"/>
        </slice>
        <from usec="0" sec="1481519204"/>
        <to usec="0" sec="1481519251"/>
    </anomaly>
    <anomaly type="suspicious" value="1.231150,1.520400,504,1 1 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="133.223.25.238" dst_port="443"/>
            <filter dst_ip="85.145.53.13" src_port="4028"/>
            <filter dst_ip="54.163.112.252" dst_port="443"/>
        </slice>
        <from usec="0" sec="1481518808"/>
        <to usec="0" sec="1481519307"/>
    </anomaly>
    <anomaly type="suspicious" value="1.241630,1.531510,011,1 1 1 0 0 0 1 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="40.126.215.194" src_port="8080"/>
        </slice>
        <from usec="0" sec="1481518890"/>
        <to usec="0" sec="1481518936"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.202.35.209" dst_ip="210.243.37.233" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481519377"/>
        <to usec="0" sec="1481519380"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="133.117.10.7" dst_ip="185.197.138.169" dst_port="53"/>
        </slice>
        <from usec="0" sec="1481519410"/>
        <to usec="0" sec="1481519424"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="60.12.109.246" src_port="33720" dst_port="2323"/>
            <filter src_ip="60.12.109.246" src_port="33720" dst_port="23"/>
        </slice>
        <from usec="0" sec="1481519030"/>
        <to usec="0" sec="1481519466"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,010,1 1 1 0 0 0 0 0 0 0 0 0,sptpDoSSYN">
        <slice>
            <filter src_ip="58.103.234.18" dst_ip="133.196.141.76" src_port="16377" dst_port="23"/>
            <filter src_ip="58.103.234.18" dst_ip="133.196.141.76" src_port="16377" dst_port="2323"/>
            <filter src_ip="58.103.234.18" dst_ip="133.196.130.225" src_port="16377" dst_port="23"/>
        </slice>
        <from usec="0" sec="1481519279"/>
        <to usec="0" sec="1481519494"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.223.12.17" dst_port="53"/>
        </slice>
        <from usec="0" sec="1481519158"/>
        <to usec="0" sec="1481519160"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,502,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="116.38.212.24" dst_ip="133.117.1.255" src_port="14205" dst_port="22"/>
            <filter src_ip="116.38.212.24" dst_ip="133.117.14.11" src_port="19217" dst_port="22"/>
            <filter src_ip="116.38.212.24" dst_ip="133.117.11.1" src_port="32489" dst_port="22"/>
            <filter src_ip="116.38.212.24" dst_ip="133.117.10.7" src_port="37197" dst_port="22"/>
            <filter src_ip="116.38.212.24" dst_ip="133.117.9.13" src_port="35513" dst_port="22"/>
        </slice>
        <from usec="0" sec="1481518897"/>
        <to usec="0" sec="1481518901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,504,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="172.144.204.35" dst_ip="203.95.129.22" src_port="443"/>
        </slice>
        <from usec="0" sec="1481518833"/>
        <to usec="0" sec="1481519643"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="180.157.117.218" dst_port="23"/>
            <filter src_ip="180.157.117.218" dst_port="53"/>
        </slice>
        <from usec="0" sec="1481519241"/>
        <to usec="0" sec="1481519243"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="208.117.50.39" dst_ip="163.34.238.74" src_port="18797" dst_port="25"/>
        </slice>
        <from usec="0" sec="1481518810"/>
        <to usec="0" sec="1481518812"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.95.134.48" dst_ip="111.89.152.235" src_port="25"/>
        </slice>
        <from usec="0" sec="1481518840"/>
        <to usec="0" sec="1481519087"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter dst_ip="52.216.253.184" dst_port="80"/>
            <filter src_ip="163.34.66.43" dst_ip="52.216.253.184" dst_port="443"/>
            <filter src_ip="163.34.66.43" dst_ip="52.7.90.202" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481519053"/>
        <to usec="0" sec="1481519059"/>
    </anomaly>
    <anomaly type="suspicious" value="1.331270,1.502090,999,1 1 1 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="202.250.170.101" src_port="25"/>
            <filter src_ip="202.250.170.101" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,502,1 1 1 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="22"/>
            <filter src_ip="81.16.96.102" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481518807"/>
        <to usec="0" sec="1481519670"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.45.15.38" dst_port="23"/>
        </slice>
        <from usec="0" sec="1481519519"/>
        <to usec="0" sec="1481519548"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="133.223.14.182" dst_ip="17.158.240.183" src_port="44867" dst_port="25"/>
        </slice>
        <from usec="0" sec="1481519419"/>
        <to usec="0" sec="1481519421"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="46.48.86.162" src_port="64072" dst_port="23"/>
        </slice>
        <from usec="0" sec="1481519241"/>
        <to usec="0" sec="1481519500"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,504,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.223.66.158" dst_port="443"/>
            <filter src_ip="133.223.66.158" dst_ip="67.50.161.162" dst_port="80"/>
            <filter src_ip="133.223.66.158" dst_ip="67.50.161.161" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481518811"/>
        <to usec="0" sec="1481519665"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="136.156.77.26" dst_ip="203.95.135.205" src_port="50426" dst_port="25"/>
        </slice>
        <from usec="0" sec="1481519000"/>
        <to usec="0" sec="1481519002"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.34.132.21" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481518836"/>
        <to usec="0" sec="1481519689"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.34.238.64" dst_port="25"/>
        </slice>
        <from usec="0" sec="1481518829"/>
        <to usec="0" sec="1481519691"/>
    </anomaly>
    <anomaly type="suspicious" value="1.331270,1.502090,503,1 1 1 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="133.223.186.111" dst_port="80"/>
            <filter src_ip="133.223.186.111" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.555790,1.591240,999,1 1 1 1 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.95.134.43" dst_port="53"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519685"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="202.239.158.137" dst_ip="202.244.73.214" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481518869"/>
        <to usec="0" sec="1481519649"/>
    </anomaly>
    <anomaly type="suspicious" value="1.241630,1.531510,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.46.56.210" dst_port="23"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481518851"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,999,1 1 1 0 0 0 0 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="203.95.143.47" dst_ip="42.248.116.72"/>
        </slice>
        <from usec="0" sec="1481518806"/>
        <to usec="0" sec="1481519654"/>
    </anomaly>
    <anomaly type="suspicious" value="1.095040,1.503780,504,1 1 1 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="202.250.170.6" dst_port="443"/>
            <filter src_ip="202.250.170.6" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481518801"/>
        <to usec="0" sec="1481519674"/>
    </anomaly>
    <anomaly type="suspicious" value="1.555790,1.591240,999,1 1 1 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.223.14.13" dst_port="53"/>
            <filter src_ip="133.223.14.11" dst_port="53"/>
            <filter src_ip="133.223.14.12" dst_port="53"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519647"/>
    </anomaly>
    <anomaly type="suspicious" value="1.241630,1.531510,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="163.34.167.231" dst_port="53"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519558"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481518998"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519088"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="110.75.107.244"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481518908"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,504,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="202.251.110.135"/>
        </slice>
        <from usec="0" sec="1481518801"/>
        <to usec="0" sec="1481518908"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="202.250.138.120"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481518990"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="183.142.95.247"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481518997"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.34.113.22"/>
        </slice>
        <from usec="0" sec="1481518803"/>
        <to usec="0" sec="1481518996"/>
    </anomaly>
    <anomaly type="suspicious" value="0.988268,1.478690,010,1 0 0 1 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="121.105.72.218" src_port="10477" dst_port="23"/>
            <filter src_ip="121.105.72.218" src_port="10477" dst_port="2323"/>
        </slice>
        <from usec="0" sec="1481518867"/>
        <to usec="0" sec="1481519494"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="94.120.243.185"/>
        </slice>
        <from usec="0" sec="1481518808"/>
        <to usec="0" sec="1481519084"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="106.159.220.78"/>
        </slice>
        <from usec="0" sec="1481518812"/>
        <to usec="0" sec="1481519080"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.95.134.43"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519178"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="14.2.42.94"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519177"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="58.76.210.100"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519176"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="115.224.100.204"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519178"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="180.86.242.172"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519177"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,020,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.117.1.255"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519175"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="125.6.8.163"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519174"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="112.38.110.204"/>
        </slice>
        <from usec="0" sec="1481518801"/>
        <to usec="0" sec="1481519176"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="66.156.57.118"/>
        </slice>
        <from usec="0" sec="1481518801"/>
        <to usec="0" sec="1481519178"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="118.49.13.234"/>
        </slice>
        <from usec="0" sec="1481518802"/>
        <to usec="0" sec="1481519178"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="111.49.32.53"/>
        </slice>
        <from usec="0" sec="1481518803"/>
        <to usec="0" sec="1481519177"/>
    </anomaly>
    <anomaly type="suspicious" value="0.988268,1.478690,504,1 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.223.5.253" dst_ip="52.0.43.220" dst_port="443"/>
        </slice>
        <from usec="0" sec="1481518803"/>
        <to usec="0" sec="1481519169"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="180.177.201.179"/>
        </slice>
        <from usec="0" sec="1481518804"/>
        <to usec="0" sec="1481519173"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,020,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="131.98.115.163"/>
        </slice>
        <from usec="0" sec="1481518807"/>
        <to usec="0" sec="1481519178"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="163.34.192.106"/>
        </slice>
        <from usec="0" sec="1481518816"/>
        <to usec="0" sec="1481519145"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.223.207.35"/>
        </slice>
        <from usec="0" sec="1481518835"/>
        <to usec="0" sec="1481519178"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,504,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="89.222.231.217"/>
        </slice>
        <from usec="0" sec="1481518940"/>
        <to usec="0" sec="1481519062"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,504,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="52.91.178.24"/>
        </slice>
        <from usec="0" sec="1481518979"/>
        <to usec="0" sec="1481519037"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.193.2.196"/>
        </slice>
        <from usec="0" sec="1481518983"/>
        <to usec="0" sec="1481519174"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="71.199.216.56" src_port="443" dst_port="443"/>
        </slice>
        <from usec="0" sec="1481518984"/>
        <to usec="0" sec="1481519178"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,504,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="52.216.253.184"/>
        </slice>
        <from usec="0" sec="1481519053"/>
        <to usec="0" sec="1481519066"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="202.251.253.127"/>
        </slice>
        <from usec="0" sec="1481519132"/>
        <to usec="0" sec="1481519150"/>
    </anomaly>
    <anomaly type="suspicious" value="1.073820,1.530500,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="117.11.150.152"/>
        </slice>
        <from usec="0" sec="1481518961"/>
        <to usec="0" sec="1481519358"/>
    </anomaly>
    <anomaly type="suspicious" value="1.148570,1.506870,010,1 0 0 1 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="217.31.128.197" src_port="80"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519159"/>
    </anomaly>
    <anomaly type="suspicious" value="1.476510,1.548380,504,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="203.95.132.76" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.241630,1.531510,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.95.134.47" dst_port="53"/>
        </slice>
        <from usec="0" sec="1481519018"/>
        <to usec="0" sec="1481519611"/>
    </anomaly>
    <anomaly type="suspicious" value="0.988268,1.478690,504,1 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.202.163.96" dst_ip="17.119.207.204" dst_port="443"/>
        </slice>
        <from usec="0" sec="1481518840"/>
        <to usec="0" sec="1481519164"/>
    </anomaly>
    <anomaly type="suspicious" value="1.090860,1.494980,020,0 0 0 0 0 0 1 0 0 1 0 0,icmp_error">
        <slice>
            <filter dst_ip="203.95.135.67"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.331270,1.502090,504,1 1 1 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="17.162.141.137" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.090860,1.494980,010,0 0 0 0 0 0 1 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="175.49.38.58" src_port="65210" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.090860,1.494980,010,0 0 0 0 0 0 1 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="211.187.58.94" src_port="45851" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.313880,1.528840,010,0 0 0 1 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="223.19.227.232" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.090860,1.494980,503,0 0 0 0 0 0 1 0 0 1 0 0,ntscACKt">
        <slice>
            <filter src_ip="96.218.229.26" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.331270,1.502090,503,1 1 1 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="202.244.73.57" dst_ip="125.2.32.242" dst_port="443"/>
            <filter src_ip="202.244.73.57" dst_ip="125.2.32.242" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.090860,1.494980,503,0 0 0 0 0 0 1 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="61.65.166.141" dst_ip="163.34.99.189" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.090860,1.494980,020,0 0 0 0 0 0 1 0 0 1 0 0,icmp_error">
        <slice>
            <filter dst_ip="163.34.137.225"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.331270,1.502090,504,1 1 1 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="133.223.70.160" dst_port="80"/>
            <filter src_ip="202.244.75.39" dst_port="443"/>
            <filter src_ip="163.34.113.188" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.415500,1.497180,503,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="163.34.112.178" dst_ip="192.28.41.219"/>
            <filter src_ip="163.34.112.178" dst_port="80"/>
            <filter src_ip="163.34.112.178" dst_port="443"/>
            <filter dst_ip="192.28.41.219" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.476510,1.548380,999,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="133.202.169.170" dst_ip="208.117.245.134" src_port="63642" dst_port="443"/>
            <filter src_ip="133.202.169.170" dst_ip="208.117.245.134" src_port="62104" dst_port="443"/>
            <filter src_ip="133.202.251.37" dst_ip="208.117.245.134" src_port="41912" dst_port="1935"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.415500,1.497180,504,1 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="163.34.123.192" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.331270,1.502090,503,1 1 1 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="163.34.113.221" dst_port="443"/>
            <filter dst_ip="65.28.6.116" dst_port="80"/>
            <filter dst_ip="17.162.141.133" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.476510,1.548380,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYNt">
        <slice>
            <filter src_ip="103.20.150.85" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.476510,1.548380,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="202.244.75.39" src_port="443"/>
            <filter dst_ip="202.244.75.39" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.476510,1.548380,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYNt">
        <slice>
            <filter src_ip="1.215.48.209" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.476510,1.548380,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYNt">
        <slice>
            <filter src_ip="190.204.104.7" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.476510,1.548380,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="198.75.209.150" dst_ip="163.34.113.155" src_port="7978" dst_port="50756"/>
            <filter src_ip="198.75.209.150" dst_ip="163.34.113.155" src_port="443" dst_port="50750"/>
            <filter src_ip="198.75.209.150" dst_ip="163.34.113.155" src_port="21" dst_port="50755"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.476510,1.548380,503,0 0 0 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="202.244.75.247" src_port="80"/>
            <filter src_ip="202.244.75.247" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.476510,1.548380,010,0 0 0 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="220.162.68.230" src_port="28222" dst_port="23"/>
            <filter src_ip="220.162.68.230" src_port="28222" dst_port="2323"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.476510,1.548380,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="31.13.55.52" dst_ip="163.34.193.231" src_port="443" dst_port="52472"/>
            <filter src_ip="31.13.55.52" dst_ip="163.34.193.231" src_port="443" dst_port="52471"/>
            <filter src_ip="31.13.55.52" dst_ip="163.34.193.231" src_port="443" dst_port="52469"/>
            <filter src_ip="31.13.55.52" dst_ip="163.34.193.231" src_port="443" dst_port="52468"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.476510,1.548380,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="31.13.63.247" dst_ip="163.34.48.113" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.476510,1.548380,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.34.194.82" src_port="80"/>
            <filter dst_ip="163.34.194.82" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.476510,1.548380,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="163.34.40.51" src_port="443"/>
            <filter src_ip="101.113.51.6" dst_ip="163.34.40.51" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.476510,1.548380,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.95.143.119" src_port="443"/>
            <filter dst_ip="203.95.143.119" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.795830,1.585000,503,1 0 0 1 0 0 1 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="52.201.212.198" dst_ip="203.95.140.82" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.995930,1.639950,504,1 1 1 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="17.135.205.18" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.856730,1.608440,504,1 1 1 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="163.34.123.238" dst_port="443"/>
            <filter dst_ip="17.239.153.84" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.762080,1.582060,999,1 1 1 0 0 0 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="203.95.135.245" dst_ip="206.212.27.126"/>
            <filter src_ip="203.95.135.245" dst_ip="204.205.209.211"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.512450,3.315530,999,1 1 1 0 0 0 1 1 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="157.172.238.98" dst_ip="202.44.246.10" dst_port="53"/>
            <filter src_ip="157.172.238.98" dst_ip="202.44.246.9" dst_port="53"/>
        </slice>
        <from usec="0" sec="1481518845"/>
        <to usec="0" sec="1481518891"/>
    </anomaly>
    <anomaly type="anomalous" value="3.512450,3.315530,999,1 1 1 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="185.127.89.46" src_port="44444" dst_port="523"/>
        </slice>
        <from usec="0" sec="1481519520"/>
        <to usec="0" sec="1481519566"/>
    </anomaly>
    <anomaly type="anomalous" value="1.697790,1.558230,503,1 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.512450,3.315530,999,1 1 1 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.131.43.145" src_port="5164" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1481518845"/>
        <to usec="0" sec="1481519251"/>
    </anomaly>
    <anomaly type="anomalous" value="3.635190,2.809410,010,1 1 1 1 1 1 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="183.244.168.26" dst_port="3306"/>
            <filter src_ip="196.59.91.63" src_port="2978" dst_port="5060"/>
            <filter src_ip="178.28.43.186" src_port="5610" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.141680,2.062810,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519088"/>
    </anomaly>
    <anomaly type="anomalous" value="4.026110,3.026360,504,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="52.87.237.218" dst_ip="163.34.52.210" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.337870,2.107540,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="83.126.91.108" dst_port="445"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519178"/>
    </anomaly>
    <anomaly type="anomalous" value="2.337870,2.107540,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="157.172.97.44" dst_ip="125.228.245.183" dst_port="80"/>
            <filter src_ip="157.172.97.44" dst_ip="203.138.113.92" dst_port="80"/>
        </slice>
        <from usec="0" sec="1481518887"/>
        <to usec="0" sec="1481519174"/>
    </anomaly>
    <anomaly type="anomalous" value="3.644150,2.819550,504,0 0 0 1 1 1 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="163.34.227.113" src_port="443"/>
            <filter dst_ip="163.34.227.113" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.026110,3.026360,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.34.2.131" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.635400,3.343550,999,1 1 1 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.95.137.255" dst_port="53"/>
        </slice>
        <from usec="0" sec="1481518800"/>
        <to usec="0" sec="1481519701"/>
    </anomaly>
    <anomaly type="anomalous" value="3.814080,2.852970,503,1 1 1 1 1 1 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.95.135.47" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.378230,3.299590,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.28.43.186" src_port="5610" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1481519520"/>
        <to usec="0" sec="1481519566"/>
    </anomaly>
    <anomaly type="anomalous" value="4.046690,3.014480,503,1 0 0 1 1 1 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="202.244.73.175" src_port="443"/>
            <filter dst_ip="202.244.73.175" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.856730,1.608440,504,1 1 1 0 0 0 1 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="133.223.13.208" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.401260,2.466150,504,1 1 1 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.046690,3.014480,504,1 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter src_ip="163.34.192.223" dst_ip="13.108.137.210"/>
            <filter src_ip="163.34.192.223" dst_port="80"/>
            <filter dst_ip="13.108.137.210" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.004140,3.000490,503,1 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="203.95.140.82" dst_ip="52.201.212.198" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.480880,1.929050,010,1 0 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.180550,3.057530,999,1 1 1 1 1 1 1 0 0 1 1 1,ntscUDP">
        <slice>
            <filter src_ip="94.134.38.213" dst_port="5060"/>
            <filter src_ip="115.224.98.230" src_port="40378" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.221120,1.857570,503,1 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="163.34.56.73" dst_ip="166.151.51.159" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.693700,1.995650,504,1 1 1 1 0 0 1 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="202.250.170.34" dst_port="443"/>
            <filter src_ip="202.18.210.6" dst_port="443"/>
            <filter src_ip="202.18.210.6" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.730220,1.589640,504,1 1 1 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.221120,1.857570,504,1 0 0 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="163.34.113.98" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.516190,1.969050,504,0 0 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.250.142.134" src_port="443"/>
            <filter dst_ip="210.156.14.225" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.260490,1.899080,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter src_ip="31.13.58.45" dst_ip="163.34.97.179"/>
            <filter dst_ip="163.34.97.179" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.335030,1.921100,999,0 0 0 0 0 0 1 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="45.236.109.30" dst_ip="203.95.138.130" dst_port="161"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.221120,1.857570,999,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="163.34.156.195" dst_ip="104.3.245.115"/>
            <filter src_ip="163.34.156.195" dst_ip="104.3.245.155"/>
            <filter src_ip="163.34.156.195" dst_port="9418"/>
            <filter src_ip="163.34.156.195" dst_port="443"/>
            <filter dst_ip="104.3.245.115" dst_port="9418"/>
            <filter dst_ip="104.3.245.155" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.004140,3.000490,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.95.135.47" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.447170,1.947570,503,0 0 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.34.98.184" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.260490,1.899080,999,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="158.69.85.183" dst_ip="163.34.65.18" src_port="1080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.079970,1.665410,503,1 1 1 1 0 0 1 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="202.244.73.9" dst_port="443"/>
            <filter src_ip="202.244.73.9" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.260490,1.899080,999,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.95.138.139" dst_ip="45.236.109.30"/>
            <filter src_ip="203.95.138.139" src_port="3001"/>
            <filter dst_ip="45.236.109.30" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.144010,3.527510,010,1 1 1 0 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="119.51.180.131" dst_port="1433"/>
            <filter src_ip="196.59.91.58" src_port="2978" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.180550,3.057530,503,1 1 1 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.244.73.9" src_port="80"/>
            <filter dst_ip="202.244.73.9" src_port="443"/>
            <filter dst_ip="202.250.170.34" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.480880,1.929050,504,1 0 0 1 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.18.210.6" src_port="443"/>
            <filter dst_ip="202.18.210.6" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
