<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.884840,2.038900,999,1 1 1 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.143.53.153" dst_port="123"/>
            <filter dst_ip="202.243.230.111" dst_port="123"/>
            <filter dst_ip="203.143.57.175" dst_port="123"/>
            <filter dst_ip="203.143.56.18" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.496440,2.030270,502,1 1 1 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="31.63.141.14" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.400800,2.083400,502,1 0 0 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="116.30.139.246" src_port="22"/>
            <filter dst_ip="192.126.83.61" src_port="5900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.580170,1.995780,504,1 1 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="202.250.244.51"/>
            <filter src_ip="202.89.181.250" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.682740,2.062220,999,1 1 1 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="41.39.43.117" dst_port="25"/>
            <filter dst_ip="203.143.61.93" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.507150,1.986450,503,1 1 1 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="163.221.34.42" dst_port="443"/>
            <filter src_ip="163.221.34.42" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.446610,2.053050,010,1 1 1 0 0 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="123.229.77.167" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.743310,2.038760,999,1 1 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="163.221.253.137" dst_ip="104.188.136.116"/>
            <filter src_ip="163.221.253.137" dst_port="443"/>
            <filter src_ip="163.221.253.113" dst_ip="104.188.136.249"/>
            <filter src_ip="163.221.253.113" dst_ip="104.188.136.116"/>
            <filter src_ip="163.221.253.113" dst_port="9418"/>
            <filter src_ip="163.221.253.113" dst_port="443"/>
            <filter dst_ip="104.188.136.116" dst_port="443"/>
            <filter src_ip="163.221.253.137" dst_ip="104.188.136.249" dst_port="9418"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.884840,2.038900,999,1 1 1 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="103.101.8.197" dst_ip="203.143.57.232" dst_port="23"/>
            <filter src_ip="95.118.49.122" dst_ip="203.143.57.232" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.446610,2.053050,010,1 1 1 0 0 0 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="221.51.100.56" src_port="50106" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.507150,1.986450,503,1 1 1 0 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="203.143.42.156" dst_port="80"/>
            <filter src_ip="203.143.42.156" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.035910,2.070720,011,1 1 1 0 0 0 1 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="71.78.20.18" dst_ip="203.143.51.137" dst_port="80"/>
            <filter src_ip="52.55.207.199" dst_ip="203.143.51.137" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.507150,1.986450,503,1 1 1 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="96.169.210.144" dst_ip="163.221.79.150" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.735060,1.995920,504,1 1 1 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="163.221.104.70" dst_port="443"/>
            <filter src_ip="163.221.33.129" dst_port="443"/>
            <filter src_ip="163.221.33.129" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.809840,2.091810,010,1 0 0 0 0 0 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="45.219.221.30" src_port="59046"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.638060,2.060320,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="117.238.226.190" src_port="443"/>
            <filter dst_ip="163.221.104.70" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.638060,2.060320,503,1 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="121.162.101.124" dst_ip="203.143.51.137" src_port="53286" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.638060,2.060320,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.221.34.199" src_port="80"/>
            <filter dst_ip="163.221.34.199" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.638060,2.060320,503,1 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="203.143.51.137" dst_ip="71.78.20.18" src_port="80"/>
            <filter src_ip="203.143.51.137" dst_ip="52.55.207.199" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.884840,2.038900,504,1 1 1 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="163.221.34.199" dst_port="80"/>
            <filter src_ip="163.221.34.199" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.750170,2.148640,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="198.173.10.72" dst_ip="163.221.34.73" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.750170,2.148640,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.221.34.42" src_port="443"/>
            <filter dst_ip="163.221.34.42" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.949880,2.157400,504,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="104.91.136.250" src_port="443"/>
            <filter dst_ip="163.221.79.74" src_port="443"/>
            <filter dst_ip="163.221.79.74" dst_port="23"/>
            <filter dst_ip="163.221.109.70" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.949880,2.157400,503,0 0 0 1 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="203.143.57.80" dst_ip="210.15.111.133" src_port="80" dst_port="34722"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.743310,2.038760,999,1 1 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.143.55.75" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.750170,2.148640,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="163.221.140.226" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.638060,2.060320,503,1 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="163.221.79.150" dst_ip="96.169.210.144" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.750170,2.148640,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.143.42.156" src_port="80"/>
            <filter dst_ip="203.143.42.156" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.750170,2.148640,999,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="133.68.52.22" dst_port="25"/>
            <filter src_ip="23.8.141.213" dst_ip="133.68.52.22" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.949880,2.157400,503,0 0 0 1 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="163.221.33.250" src_port="80"/>
            <filter src_ip="183.63.180.64" dst_ip="163.221.33.250" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.750170,2.148640,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="133.231.252.156" dst_ip="50.82.73.140" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.750170,2.148640,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="203.143.53.117" dst_ip="68.180.239.16" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.090540,2.079670,504,1 1 0 1 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.89.181.250" src_port="443"/>
            <filter dst_ip="202.89.181.250" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.800110,2.753410,999,1 1 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.143.55.75" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.480740,4.449770,999,1 1 1 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.143.57.216" dst_port="53"/>
        </slice>
        <from usec="0" sec="1483246800"/>
        <to usec="0" sec="1483246853"/>
    </anomaly>
    <anomaly type="anomalous" value="3.752990,2.769410,010,1 0 0 1 1 1 0 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="59.14.121.32" src_port="43191" dst_port="80"/>
            <filter src_ip="59.14.121.32" src_port="42307" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.803260,2.835730,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="17.29.169.215" src_port="80"/>
            <filter dst_ip="163.221.130.87" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.071610,2.048140,504,1 1 1 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="163.221.33.133" dst_port="443"/>
            <filter dst_ip="104.207.110.6" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="6.538490,4.786950,010,1 1 1 1 1 1 1 1 1 1 1 0,ntscSYNt">
        <slice>
            <filter src_ip="221.51.100.51" src_port="60486" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="6.635730,4.808960,503,1 1 1 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.143.57.80" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.752990,2.769410,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.143.57.80" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.803260,2.835730,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.221.253.212"/>
            <filter src_ip="192.158.130.177" dst_ip="163.221.211.153" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.942920,2.777150,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="183.67.203.231" dst_port="1433"/>
            <filter src_ip="183.67.203.231" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.071610,2.048140,999,1 1 1 1 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.143.57.232" dst_ip="206.35.99.14"/>
            <filter src_ip="203.143.57.232" dst_ip="204.125.210.31"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
