<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="suspicious" value="1.258970,1.553580,503,1 1 1 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.5.208.20" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039610,1.473760,503,1 1 0 1 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="133.124.109.186" dst_port="80"/>
            <filter src_ip="133.124.109.190" dst_port="80"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012468"/>
    </anomaly>
    <anomaly type="suspicious" value="1.209830,1.573900,999,1 1 1 0 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="193.0.125.134" dst_ip="203.76.158.58" dst_port="161"/>
            <filter src_ip="193.0.125.134" dst_ip="203.76.158.60" dst_port="161"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012425"/>
    </anomaly>
    <anomaly type="suspicious" value="1.029570,1.462670,503,1 1 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.5.130.72" dst_ip="175.191.227.191" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.209830,1.573900,010,1 1 1 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="181.94.109.183" dst_port="23"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486011667"/>
    </anomaly>
    <anomaly type="suspicious" value="1.209830,1.573900,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.205.103.121" dst_port="23"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486011646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.209830,1.573900,010,1 1 1 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="190.17.205.137" dst_port="23"/>
        </slice>
        <from usec="0" sec="1486011697"/>
        <to usec="0" sec="1486012411"/>
    </anomaly>
    <anomaly type="suspicious" value="1.209830,1.573900,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="88.198.138.174" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486011646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.209830,1.573900,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="5.201.182.205" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1486012365"/>
        <to usec="0" sec="1486012411"/>
    </anomaly>
    <anomaly type="suspicious" value="1.579720,1.655260,999,1 1 1 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="61.64.185.110" dst_ip="202.3.186.242" dst_port="53"/>
            <filter src_ip="61.64.185.126" dst_ip="202.3.186.242" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012498"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037920,1.552570,504,1 1 1 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter src_ip="163.5.127.33" dst_port="80"/>
            <filter dst_ip="199.210.236.115" dst_port="80"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012494"/>
    </anomaly>
    <anomaly type="suspicious" value="1.585750,1.665950,504,1 1 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.5.139.84" dst_ip="198.92.141.159" dst_port="443"/>
        </slice>
        <from usec="0" sec="1486011601"/>
        <to usec="0" sec="1486012416"/>
    </anomaly>
    <anomaly type="suspicious" value="1.475910,1.688900,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.475910,1.688900,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.523300,1.679700,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.5.131.203" dst_ip="198.68.8.89" dst_port="80"/>
        </slice>
        <from usec="0" sec="1486012227"/>
        <to usec="0" sec="1486012396"/>
    </anomaly>
    <anomaly type="suspicious" value="1.523300,1.679700,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="198.68.8.89" dst_ip="163.5.131.203" src_port="80"/>
        </slice>
        <from usec="0" sec="1486012227"/>
        <to usec="0" sec="1486012318"/>
    </anomaly>
    <anomaly type="suspicious" value="1.523300,1.679700,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="191.204.51.90" src_port="34793" dst_port="23"/>
            <filter src_ip="191.204.51.90" src_port="34793" dst_port="2323"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.523300,1.679700,010,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="200.191.251.90" dst_port="23"/>
            <filter src_ip="200.191.251.90" dst_port="2323"/>
            <filter dst_ip="203.76.229.52" dst_port="23"/>
            <filter dst_ip="203.76.229.52" dst_port="2323"/>
            <filter src_port="19572" dst_port="23"/>
            <filter src_port="19572" dst_port="2323"/>
            <filter src_ip="200.191.251.90" dst_ip="203.76.229.52" src_port="19572"/>
            <filter dst_ip="203.76.229.52" src_port="49647" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012350"/>
    </anomaly>
    <anomaly type="suspicious" value="1.502810,1.638340,503,1 0 0 1 1 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.5.1.201" dst_ip="208.84.113.45"/>
            <filter src_ip="163.5.1.201" dst_port="80"/>
            <filter src_ip="163.5.1.201" dst_port="443"/>
            <filter dst_ip="208.84.113.45" dst_port="80"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.239540,1.479910,999,0 0 0 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="203.76.144.184" src_port="30303"/>
            <filter src_ip="203.76.144.184" dst_port="30303"/>
            <filter src_ip="203.76.159.38" src_port="30303"/>
            <filter src_ip="203.76.159.38" dst_port="30303"/>
            <filter src_port="30303" dst_port="30303"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.039610,1.473760,999,1 1 0 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.124.56.76" src_port="53"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012426"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037920,1.552570,010,1 1 1 1 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="192.168.1.234" dst_port="23"/>
        </slice>
        <from usec="0" sec="1486011601"/>
        <to usec="0" sec="1486012246"/>
    </anomaly>
    <anomaly type="suspicious" value="1.309320,1.540920,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.254.198.1" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486011685"/>
        <to usec="0" sec="1486012428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.309320,1.540920,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.254.225.18" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486011718"/>
        <to usec="0" sec="1486012273"/>
    </anomaly>
    <anomaly type="suspicious" value="1.309320,1.540920,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.76.148.130" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486011832"/>
        <to usec="0" sec="1486012288"/>
    </anomaly>
    <anomaly type="suspicious" value="1.309320,1.540920,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.247.226.244" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486011939"/>
        <to usec="0" sec="1486012475"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="91.251.69.15" src_port="52905"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486011646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="133.146.99.14" src_port="53"/>
            <filter dst_ip="133.146.99.14" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486011646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,503,0 0 0 0 0 0 1 1 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="202.231.112.138" dst_ip="163.5.177.109" src_port="80"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486011646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.103.76.122" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486011736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.76.158.73" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486011646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.76.148.202" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486011690"/>
        <to usec="0" sec="1486011736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.76.149.197" src_port="53"/>
            <filter dst_ip="203.76.149.197" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486011736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.5.224.27" src_port="53"/>
        </slice>
        <from usec="0" sec="1486012140"/>
        <to usec="0" sec="1486012186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,020,0 0 0 0 0 0 1 1 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="163.5.217.226"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.103.78.53" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1486012140"/>
        <to usec="0" sec="1486012186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.72.207.106" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.72.207.118" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1486012140"/>
        <to usec="0" sec="1486012186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.585750,1.665950,504,1 1 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter src_ip="163.5.127.211" dst_port="80"/>
            <filter src_ip="163.5.21.162" dst_port="80"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012499"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.103.76.42" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.178950,1.563640,999,0 0 0 1 0 0 0 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.5.127.83" src_port="30303" dst_port="30303"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,503,0 0 0 0 0 0 1 1 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="23.32.241.207" dst_ip="202.247.224.140" src_port="80"/>
            <filter src_ip="23.32.241.246" dst_ip="202.247.224.140" src_port="80"/>
        </slice>
        <from usec="0" sec="1486012140"/>
        <to usec="0" sec="1486012186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.72.206.150" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1486012140"/>
        <to usec="0" sec="1486012186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.5.190.13" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486012140"/>
        <to usec="0" sec="1486012186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.76.149.210" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486011690"/>
        <to usec="0" sec="1486012186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.76.149.212" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486012140"/>
        <to usec="0" sec="1486012186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.76.149.197" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486012140"/>
        <to usec="0" sec="1486012186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.76.147.178" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486012140"/>
        <to usec="0" sec="1486012186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.309320,1.540920,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.76.158.73" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486011690"/>
        <to usec="0" sec="1486012467"/>
    </anomaly>
    <anomaly type="suspicious" value="1.309320,1.540920,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.76.145.109" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.247.226.249" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486012140"/>
        <to usec="0" sec="1486012186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.332790,1.584830,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="163.5.224.27" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486012275"/>
        <to usec="0" sec="1486012321"/>
    </anomaly>
    <anomaly type="suspicious" value="1.180830,1.490340,503,0 0 0 0 0 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.5.178.192" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.459700,1.491520,504,1 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.76.159.178" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.003970,1.467790,010,0 0 0 1 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="193.124.115.71" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.003970,1.467790,503,0 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="163.5.127.211" src_port="80"/>
            <filter src_ip="50.117.80.11" dst_ip="163.5.131.139" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.972603,1.420270,502,1 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="122.50.229.7" dst_ip="210.100.29.46"/>
            <filter src_ip="218.190.70.30" dst_ip="210.100.29.46"/>
            <filter dst_ip="210.100.29.46" dst_port="22"/>
            <filter src_ip="122.50.229.7" dst_ip="210.100.31.118" dst_port="22"/>
            <filter src_ip="218.190.70.30" dst_ip="210.100.31.118" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.480780,1.536840,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="104.187.254.74" dst_ip="163.5.130.214" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.480780,1.536840,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="202.41.220.88" dst_ip="163.5.99.37" src_port="80"/>
            <filter src_ip="202.41.220.88" dst_ip="163.5.130.246" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.480780,1.536840,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.5.99.134" src_port="80"/>
            <filter dst_ip="163.5.99.134" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.480780,1.536840,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="52.180.31.184" dst_ip="163.5.73.38" src_port="443" dst_port="53613"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.037920,1.552570,503,1 1 1 1 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.5.98.84" dst_port="80"/>
            <filter src_ip="163.5.98.84" dst_port="443"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012457"/>
    </anomaly>
    <anomaly type="anomalous" value="1.773510,1.646820,999,1 1 1 0 0 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="122.19.67.206" dst_port="123"/>
            <filter dst_ip="203.76.149.252" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.706420,1.609380,999,1 1 1 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.5.190.79" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.443670,2.444500,503,1 1 1 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.76.148.85" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.076610,1.683070,504,1 0 0 1 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="133.124.208.247" dst_port="443"/>
            <filter src_ip="133.124.6.24" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.247950,2.361020,503,1 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="203.76.154.80" dst_ip="52.18.64.94" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.507590,1.481100,504,1 0 0 1 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="163.5.99.134" dst_port="80"/>
            <filter src_ip="163.5.99.134" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.517270,1.899770,999,0 0 0 1 1 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.76.157.51" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.076610,1.683070,504,1 0 0 1 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="203.76.159.178" src_port="28179"/>
            <filter src_ip="203.76.159.178" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.119090,2.077450,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012428"/>
    </anomaly>
    <anomaly type="anomalous" value="1.888950,1.756510,010,1 1 1 1 1 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.69.158.136" dst_port="22"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012501"/>
    </anomaly>
    <anomaly type="anomalous" value="2.717740,2.435640,999,1 0 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.146.99.226" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012225"/>
    </anomaly>
    <anomaly type="anomalous" value="3.590360,2.497660,503,1 1 1 1 1 1 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.76.148.85" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.173660,1.745280,999,1 1 0 1 1 0 1 1 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.76.149.197" src_port="53"/>
            <filter src_ip="203.76.149.197" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.583130,1.521710,020,1 0 0 1 0 0 1 1 0 1 0 0,icmp_error">
        <slice>
            <filter dst_ip="203.76.148.4"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.921210,1.588420,999,1 0 0 0 0 0 1 1 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.76.148.175" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.113910,1.718940,502,1 0 0 1 1 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter src_port="22"/>
            <filter src_ip="133.146.106.1" dst_ip="64.91.31.224"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.691470,2.441990,999,1 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.76.148.202" dst_port="53"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486011668"/>
    </anomaly>
    <anomaly type="anomalous" value="2.702960,2.469930,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.72.207.118" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486011646"/>
    </anomaly>
    <anomaly type="anomalous" value="2.717740,2.435640,999,1 0 0 1 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="45.184.30.230" dst_ip="203.76.157.61" dst_port="161"/>
        </slice>
        <from usec="0" sec="1486011600"/>
        <to usec="0" sec="1486012411"/>
    </anomaly>
    <anomaly type="anomalous" value="3.412190,2.444250,503,0 0 0 1 1 1 0 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.5.130.72" src_port="443"/>
            <filter src_ip="175.191.227.191" dst_ip="163.5.130.72" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.479880,2.423400,503,1 0 0 1 1 1 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.76.152.201" src_port="443"/>
            <filter dst_ip="203.76.152.201" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.981950,2.985620,504,1 1 0 1 1 1 1 1 1 1 1 0,mptp">
        <slice>
            <filter dst_ip="202.25.93.253" src_port="443"/>
            <filter dst_ip="202.25.93.253" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.042110,1.692250,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="163.5.127.236" dst_port="443"/>
            <filter src_ip="133.124.205.180" dst_port="443"/>
            <filter dst_ip="17.199.79.10" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.590360,2.497660,503,1 1 1 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="202.254.254.56"/>
            <filter dst_port="80"/>
            <filter src_ip="202.25.93.253" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.969370,2.503980,999,1 1 1 1 0 0 1 1 1 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="163.91.118.240" dst_port="5098"/>
            <filter src_ip="163.91.118.240" dst_port="5097"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.590280,1.511590,504,1 1 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="23.106.90.157" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.076610,1.683070,999,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.76.157.51" dst_ip="45.184.30.230"/>
            <filter src_ip="203.76.157.51" src_port="3001"/>
            <filter dst_ip="45.184.30.230" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.247950,2.361020,999,1 0 0 1 1 1 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="104.125.6.128" dst_ip="163.5.196.163"/>
            <filter src_ip="104.125.6.128" src_port="9418"/>
            <filter src_ip="104.125.6.101" dst_ip="163.5.196.163"/>
            <filter src_ip="104.125.6.101" src_port="443"/>
            <filter dst_ip="163.5.196.163" src_port="443"/>
            <filter dst_ip="163.5.196.163" src_port="9418"/>
            <filter src_ip="188.49.31.242" src_port="10425" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.507590,1.481100,503,1 0 0 1 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="163.5.98.175" dst_ip="64.27.216.36" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.225170,1.796980,503,1 1 1 0 0 0 0 0 0 1 1 1,ntscACK">
        <slice>
            <filter src_ip="163.5.129.169" dst_port="80"/>
            <filter src_ip="163.5.98.168" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.069990,2.493640,999,0 0 0 1 0 0 1 1 1 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.247.227.174" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.076610,1.683070,503,1 0 0 1 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="52.18.64.94" dst_ip="203.76.154.80" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.199910,3.075990,503,1 0 0 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.5.130.114" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.057950,1.683100,503,1 0 0 1 1 0 0 0 0 1 1 0,point_to_point">
        <slice>
            <filter src_ip="64.27.216.36" dst_ip="163.5.98.175" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.091490,1.723360,503,0 0 0 1 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="107.90.186.233" dst_ip="163.5.129.140" src_port="443"/>
            <filter src_ip="151.86.120.245" dst_ip="163.5.129.140" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.423360,1.769510,503,1 0 0 1 0 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.5.129.169" src_port="80"/>
            <filter dst_ip="163.5.129.169" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.057230,1.732320,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="17.194.167.252" dst_ip="163.5.22.228" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.057230,1.732320,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="198.92.141.128" dst_ip="163.5.25.239" src_port="443" dst_port="49290"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.747570,1.599720,504,1 1 1 1 0 0 0 0 0 1 1 0,ntscACK">
        <slice>
            <filter src_ip="31.254.189.249" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.057230,1.732320,010,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.5.228.21" dst_port="2222"/>
            <filter src_ip="42.146.249.111" dst_ip="163.5.190.36" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.753970,1.968000,502,1 1 1 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="116.1.117.225" dst_port="22"/>
            <filter src_ip="218.103.188.121" dst_port="53413"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.057230,1.732320,503,0 0 0 0 0 0 0 0 0 1 1 1,malphfl">
        <slice>
            <filter src_ip="23.32.241.228" dst_ip="133.146.100.8" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.337620,2.397370,010,0 0 0 1 1 1 1 0 0 1 1 1,sntscSYNt">
        <slice>
            <filter src_ip="91.223.207.247" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.291900,3.134830,503,1 1 1 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="202.254.254.56" src_port="80"/>
            <filter dst_ip="202.254.254.56" src_port="443"/>
            <filter dst_ip="202.254.254.56" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.935330,2.033650,010,1 1 1 1 1 0 1 1 0 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="59.193.69.229" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.199910,3.075990,503,1 0 0 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="202.247.227.12" src_port="443"/>
            <filter dst_ip="202.247.227.12" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.042110,1.692250,999,1 0 0 0 0 0 0 0 0 1 1 1,point_to_point">
        <slice>
            <filter src_ip="192.5.220.72" dst_ip="203.76.155.202" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
