<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="anomalous" value="2.91525,1.96122,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="49.8.143.173" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.6239,1.48462,504,1 1 1 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="163.95.225.49" dst_port="443"/>
            <filter dst_ip="17.58.73.213" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.07288,1.93687,010,1 1 1 0 0 0 1 1 1 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="195.130.160.209" src_port="234" dst_port="50802"/>
        </slice>
        <from usec="0" sec="1491282225"/>
        <to usec="0" sec="1491282271"/>
    </anomaly>
    <anomaly type="anomalous" value="1.46438,1.41018,503,1 1 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="133.228.214.241" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.72557,1.89241,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.178.137.172" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.41201,1.89095,503,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="202.53.192.213" dst_ip="68.54.197.46" src_port="80"/>
        </slice>
        <from usec="0" sec="1491282002"/>
        <to usec="0" sec="1491282191"/>
    </anomaly>
    <anomaly type="anomalous" value="2.73324,1.91084,503,0 0 0 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="203.178.131.78" dst_ip="186.140.38.144" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.10731,1.91473,999,1 1 1 0 0 0 1 1 1 1 0 0,ptmp">
        <slice>
            <filter src_ip="203.178.136.59" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.32561,2.29722,503,1 1 0 1 1 1 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.178.137.172" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.86705,1.86089,999,1 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.114.6.125" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282271"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4392,1.9563,010,1 1 1 0 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_port="53413"/>
            <filter src_ip="91.119.8.245" src_port="42824" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.85157,1.89656,504,1 0 0 1 1 1 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.230.221.29" src_port="443"/>
            <filter dst_ip="202.230.221.29" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.82751,1.48992,503,1 1 1 0 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.178.131.78" dst_port="80"/>
            <filter dst_ip="163.95.115.217" dst_port="443"/>
            <filter dst_ip="163.95.115.219" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.72645,1.92992,999,1 1 1 1 1 1 1 1 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="62.237.115.251" dst_ip="203.178.136.54" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.91617,1.85681,010,0 0 0 0 0 0 1 1 1 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="80.178.62.26" src_port="58401" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.28379,2.29659,010,0 0 0 1 1 1 1 1 1 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="104.95.65.113" dst_port="995"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.82117,1.52894,999,0 0 0 1 0 0 1 1 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.95.64.41" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.99039,1.97117,503,1 1 1 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="80"/>
            <filter src_ip="202.57.57.50" dst_port="443"/>
            <filter src_ip="202.230.221.29" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.73324,1.91084,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.95.135.14" src_port="443"/>
            <filter dst_ip="163.95.135.14" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.60336,1.41471,504,0 0 0 0 0 0 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.57.14.130" src_port="443"/>
            <filter dst_ip="202.57.14.130" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.39887,2.34366,504,1 1 1 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.53.192.58" src_port="443"/>
            <filter dst_ip="202.53.192.58" src_port="80"/>
            <filter dst_ip="202.53.192.175" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.85157,1.89656,504,1 0 0 1 1 1 1 1 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="117.242.237.69" src_port="443"/>
            <filter src_ip="117.242.237.69" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.85157,1.89656,504,1 0 0 1 1 1 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.57.57.50" src_port="443"/>
            <filter dst_ip="202.57.57.50" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.90686,1.91572,504,1 1 0 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.59024,1.38971,503,1 0 0 0 0 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.178.128.208" src_port="443"/>
            <filter dst_ip="203.178.128.208" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.39887,2.34366,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="66.194.181.81" dst_port="80"/>
            <filter src_ip="45.52.124.82" dst_port="1434"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.6239,1.48462,504,1 1 1 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="202.57.14.130" dst_port="443"/>
            <filter src_ip="203.178.128.208" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.46438,1.41018,503,1 1 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="17.58.73.215" dst_port="443"/>
            <filter dst_ip="17.58.73.215" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.73324,1.91084,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="163.95.134.213" dst_port="443"/>
            <filter src_ip="163.95.134.213" dst_port="80"/>
            <filter dst_ip="52.246.192.206" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,999,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="64.251.235.187" dst_ip="203.178.147.3" dst_port="53"/>
            <filter src_ip="99.138.238.129" dst_ip="203.178.147.3" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282896"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25846,1.42269,504,1 1 1 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.95.119.19" dst_port="443"/>
            <filter dst_ip="163.95.119.19" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="115.46.0.210" dst_port="23"/>
        </slice>
        <from usec="0" sec="1491282340"/>
        <to usec="0" sec="1491282363"/>
    </anomaly>
    <anomaly type="suspicious" value="1.11501,1.4509,020,1 1 1 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="179.61.208.173"/>
        </slice>
        <from usec="0" sec="1491282495"/>
        <to usec="0" sec="1491282541"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="93.110.123.147" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282155"/>
        <to usec="0" sec="1491282161"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="180.23.113.101" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282559"/>
        <to usec="0" sec="1491282564"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,999,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.57.57.120" dst_port="25"/>
        </slice>
        <from usec="0" sec="1491282336"/>
        <to usec="0" sec="1491282404"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="66.110.104.198" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282752"/>
        <to usec="0" sec="1491282757"/>
    </anomaly>
    <anomaly type="suspicious" value="1.11501,1.4509,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="195.130.162.74" src_port="303" dst_port="50804"/>
        </slice>
        <from usec="0" sec="1491282304"/>
        <to usec="0" sec="1491282867"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25846,1.42269,999,1 1 1 0 0 0 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="203.178.137.8" dst_ip="206.37.27.14"/>
            <filter src_ip="203.178.137.8" dst_ip="204.60.210.39"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="87.110.49.21" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282692"/>
        <to usec="0" sec="1491282702"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="141.84.127.241" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282283"/>
        <to usec="0" sec="1491282289"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="193.6.149.191" dst_port="23"/>
        </slice>
        <from usec="0" sec="1491282389"/>
        <to usec="0" sec="1491282400"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="109.228.189.85" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282481"/>
        <to usec="0" sec="1491282485"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="91.101.147.109" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282223"/>
        <to usec="0" sec="1491282231"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="69.254.36.4" dst_port="23"/>
        </slice>
        <from usec="0" sec="1491282411"/>
        <to usec="0" sec="1491282422"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="125.177.243.106" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282261"/>
        <to usec="0" sec="1491282265"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.117.155.41" dst_port="23"/>
        </slice>
        <from usec="0" sec="1491282317"/>
        <to usec="0" sec="1491282328"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="67.64.5.199" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282258"/>
        <to usec="0" sec="1491282263"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="84.14.21.202" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282404"/>
        <to usec="0" sec="1491282410"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="94.133.137.153" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282487"/>
        <to usec="0" sec="1491282492"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="5.64.3.169" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282663"/>
        <to usec="0" sec="1491282666"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="188.188.144.148" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282091"/>
        <to usec="0" sec="1491282096"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="109.118.124.162" dst_port="23"/>
        </slice>
        <from usec="0" sec="1491282606"/>
        <to usec="0" sec="1491282619"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="213.47.128.162" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282378"/>
        <to usec="0" sec="1491282383"/>
    </anomaly>
    <anomaly type="suspicious" value="1.11501,1.4509,010,1 1 1 0 0 0 1 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="10.0.0.254" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282058"/>
        <to usec="0" sec="1491282541"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="104.108.150.212"/>
        </slice>
        <from usec="0" sec="1491282476"/>
        <to usec="0" sec="1491282873"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="195.130.205.56" src_port="5074" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1491282194"/>
        <to usec="0" sec="1491282195"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="182.80.188.50" src_port="3083" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1491282269"/>
        <to usec="0" sec="1491282271"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="115.3.72.199" src_port="22841" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282073"/>
        <to usec="0" sec="1491282896"/>
    </anomaly>
    <anomaly type="suspicious" value="1.11501,1.4509,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="176.148.252.246" dst_port="23"/>
        </slice>
        <from usec="0" sec="1491282495"/>
        <to usec="0" sec="1491282541"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="187.168.67.12" dst_port="23"/>
        </slice>
        <from usec="0" sec="1491282576"/>
        <to usec="0" sec="1491282589"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="72.122.217.35" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282165"/>
        <to usec="0" sec="1491282170"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="115.90.1.210" dst_port="23"/>
        </slice>
        <from usec="0" sec="1491282276"/>
        <to usec="0" sec="1491282288"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="73.163.90.196" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282395"/>
        <to usec="0" sec="1491282400"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="181.145.115.162" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282318"/>
        <to usec="0" sec="1491282325"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="31.163.85.110" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282555"/>
        <to usec="0" sec="1491282556"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="67.87.34.149" dst_port="23"/>
        </slice>
        <from usec="0" sec="1491282857"/>
        <to usec="0" sec="1491282869"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="185.137.112.140" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282483"/>
        <to usec="0" sec="1491282489"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="202.167.13.241" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1491282369"/>
        <to usec="0" sec="1491282370"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="81.215.89.249" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1491282215"/>
        <to usec="0" sec="1491282226"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="23.99.63.156" dst_port="23"/>
        </slice>
        <from usec="0" sec="1491282658"/>
        <to usec="0" sec="1491282669"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="36.46.155.225" dst_port="23"/>
        </slice>
        <from usec="0" sec="1491282205"/>
        <to usec="0" sec="1491282240"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="91.239.40.123" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282215"/>
        <to usec="0" sec="1491282220"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="77.201.208.18" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282151"/>
        <to usec="0" sec="1491282156"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="89.149.246.50" dst_port="22"/>
        </slice>
        <from usec="0" sec="1491282234"/>
        <to usec="0" sec="1491282238"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="107.33.40.36"/>
        </slice>
        <from usec="0" sec="1491282121"/>
        <to usec="0" sec="1491282123"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="49.8.143.173" src_port="3306" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1491282758"/>
        <to usec="0" sec="1491282760"/>
    </anomaly>
    <anomaly type="suspicious" value="1.35311,1.4349,503,1 1 1 0 0 0 1 1 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="91.120.12.240" dst_ip="163.95.119.24" dst_port="80"/>
            <filter src_ip="46.33.118.215" dst_ip="163.95.119.24" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.41929,1.55767,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282468"/>
    </anomaly>
    <anomaly type="suspicious" value="1.41929,1.55767,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282288"/>
    </anomaly>
    <anomaly type="suspicious" value="1.45494,1.5763,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282468"/>
    </anomaly>
    <anomaly type="suspicious" value="1.45494,1.5763,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282288"/>
    </anomaly>
    <anomaly type="suspicious" value="1.45494,1.5763,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282198"/>
    </anomaly>
    <anomaly type="suspicious" value="1.45494,1.5763,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282468"/>
    </anomaly>
    <anomaly type="suspicious" value="0.935961,1.36224,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.137.126" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.87824,1.87964,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="45.52.123.201" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.57.29.29" src_port="53"/>
            <filter dst_ip="202.57.29.29" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.53.114.201" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.23185,1.34957,503,0 0 0 0 0 0 1 1 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="202.39.100.116" dst_ip="163.95.16.125" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,020,0 0 0 0 0 0 1 1 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="203.178.137.227" src_port="53"/>
            <filter dst_ip="203.178.137.227"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,504,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="210.1.110.15" dst_ip="163.95.251.72" src_port="443"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.03046,1.35665,011,0 0 0 0 0 0 1 1 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="149.186.220.100" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.53.48.88" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00992,1.33056,999,1 0 0 0 0 0 1 1 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.57.7.9" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.57.33.29" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.136.35" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09286,1.38879,999,1 1 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.136.37" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282725"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="61.184.158.239" dst_ip="192.50.54.198" dst_port="53"/>
            <filter src_ip="61.184.158.254" dst_ip="192.50.54.198" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.136.59" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.136.62" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.23185,1.34957,999,0 0 0 0 0 0 1 1 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.137.78" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.935961,1.36224,999,1 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.178.132.154" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282288"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.133.149" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.141.197" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="203.146.159.18" dst_ip="203.178.134.91" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.143.66" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.53.193.176" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.53.193.184" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.57.33.29" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282090"/>
        <to usec="0" sec="1491282136"/>
    </anomaly>
    <anomaly type="suspicious" value="1.23185,1.34957,502,0 0 0 0 0 0 1 1 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="59.209.81.38" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.136.35" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282090"/>
        <to usec="0" sec="1491282586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,502,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="218.111.97.46" src_port="22"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.246.174.57" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.136.62" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282090"/>
        <to usec="0" sec="1491282136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.246.174.88" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.53.49.93" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1491282090"/>
        <to usec="0" sec="1491282586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.246.173.183" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.141.197" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282090"/>
        <to usec="0" sec="1491282136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.246.173.251" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.134.91" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282090"/>
        <to usec="0" sec="1491282136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.53.48.74" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="104.67.7.184"/>
        </slice>
        <from usec="0" sec="1491282090"/>
        <to usec="0" sec="1491282136"/>
    </anomaly>
    <anomaly type="suspicious" value="1.87824,1.87964,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="45.52.123.196" dst_port="995"/>
        </slice>
        <from usec="0" sec="1491282225"/>
        <to usec="0" sec="1491282271"/>
    </anomaly>
    <anomaly type="suspicious" value="1.87824,1.87964,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.228.127.243" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282225"/>
        <to usec="0" sec="1491282271"/>
    </anomaly>
    <anomaly type="suspicious" value="1.87824,1.87964,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="45.52.124.193" dst_port="5901"/>
        </slice>
        <from usec="0" sec="1491282315"/>
        <to usec="0" sec="1491282361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87908,1.31738,503,1 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="133.251.85.203" dst_ip="113.7.44.46" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87908,1.31738,504,1 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="163.95.63.66" dst_ip="17.62.154.22" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.03046,1.35665,010,0 0 0 0 0 0 1 1 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="150.53.49.73" dst_port="54756"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87908,1.31738,503,1 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.95.119.26" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.992072,1.45893,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.178.143.5" dst_port="53"/>
        </slice>
        <from usec="0" sec="1491282018"/>
        <to usec="0" sec="1491282488"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25846,1.42269,010,1 1 1 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="221.82.244.197" src_port="49100" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25846,1.42269,502,1 1 1 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="59.209.81.38" dst_port="22"/>
            <filter src_ip="116.227.236.6" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00992,1.33056,999,1 0 0 0 0 0 1 1 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="203.178.141.202" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.35133,1.38404,999,1 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.178.132.20" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.36674,1.40914,999,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter src_ip="45.63.165.77" dst_ip="203.178.132.20"/>
            <filter dst_ip="203.178.132.20" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="131.78.122.135" dst_ip="220.75.97.87" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,502,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="118.106.135.4" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,502,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="133.228.218.207" dst_ip="218.116.50.121" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.23185,1.34957,999,0 0 0 0 0 0 1 1 0 1 1 0,ptpposcaUDP">
        <slice>
            <filter src_ip="140.186.38.196" dst_ip="203.178.136.59" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.95.27.97" src_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.36674,1.40914,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="17.61.134.82" dst_ip="202.53.195.76" src_port="443" dst_port="52458"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.36674,1.40914,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="17.58.73.198" dst_ip="163.95.146.107" src_port="80" dst_port="51505"/>
            <filter src_ip="17.58.73.198" dst_ip="163.95.146.107" src_port="80" dst_port="51504"/>
            <filter src_ip="17.58.73.198" dst_ip="163.95.146.107" src_port="80" dst_port="51503"/>
            <filter src_ip="17.58.73.198" dst_ip="163.95.40.239" src_port="443" dst_port="58778"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="173.18.123.240" dst_ip="163.95.61.82" src_port="443" dst_port="54085"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.36674,1.40914,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="1.188.209.78" dst_ip="202.53.192.210" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,502,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="182.149.255.112" dst_ip="203.178.151.195" dst_port="22"/>
            <filter src_ip="182.149.255.112" dst_ip="203.178.151.197" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.23185,1.34957,504,0 0 0 0 0 0 1 1 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="163.95.30.234" src_port="443"/>
            <filter dst_ip="163.95.30.234" src_port="80"/>
            <filter dst_ip="163.95.30.232" src_port="443"/>
            <filter dst_ip="163.95.30.232" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.36674,1.40914,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.95.145.143" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,999,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="192.42.147.50" dst_ip="203.178.130.221"/>
            <filter src_ip="192.42.147.50" dst_ip="203.178.130.222"/>
            <filter src_ip="192.42.147.50" dst_ip="203.178.130.223"/>
            <filter dst_ip="203.178.130.221" src_port="500"/>
            <filter dst_ip="203.178.130.221"/>
            <filter dst_ip="203.178.130.221" dst_port="500"/>
            <filter dst_ip="203.178.130.221"/>
            <filter dst_ip="203.178.130.222" src_port="500"/>
            <filter dst_ip="203.178.130.222"/>
            <filter dst_ip="203.178.130.222" dst_port="500"/>
            <filter dst_ip="203.178.130.222"/>
            <filter dst_ip="203.178.130.223" src_port="500"/>
            <filter dst_ip="203.178.130.223"/>
            <filter dst_ip="203.178.130.223" dst_port="500"/>
            <filter dst_ip="203.178.130.223"/>
            <filter src_ip="192.42.147.50" src_port="500" dst_port="500"/>
            <filter src_ip="192.42.147.50"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="194.122.126.77" dst_ip="163.95.145.153" src_port="80" dst_port="25465"/>
            <filter src_ip="194.122.126.77" dst_ip="163.95.145.153" src_port="80" dst_port="25395"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,020,0 0 0 0 0 0 0 0 0 1 1 0,ttl_error">
        <slice>
            <filter src_ip="202.57.20.50"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.57.20.223" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="202.57.57.41" dst_ip="220.238.143.48" src_port="443"/>
            <filter src_ip="202.57.57.41" dst_ip="220.238.143.48" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.36674,1.40914,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="203.178.128.235" dst_ip="64.135.30.33" dst_port="10050"/>
            <filter src_ip="203.178.128.235" dst_ip="64.135.42.89" dst_port="10050"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,020,0 0 0 0 0 0 0 0 0 1 1 0,ttl_error">
        <slice>
            <filter src_ip="203.178.140.63"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,502,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="203.178.141.49" dst_ip="175.198.75.175" src_port="22"/>
            <filter src_ip="203.178.141.49" dst_ip="116.227.236.6" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="203.178.141.73" dst_port="53"/>
            <filter src_ip="203.178.141.73" dst_ip="62.237.115.251" src_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958084,1.38773,504,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.95.115.219" dst_port="443"/>
        </slice>
        <from usec="0" sec="1491282000"/>
        <to usec="0" sec="1491282046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="71.229.120.100" src_port="58022"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="71.229.97.197" src_port="58022"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="71.229.36.195" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="74.121.120.184" dst_ip="163.95.147.215" src_port="443" dst_port="49968"/>
            <filter src_ip="74.121.120.184" dst_ip="163.95.147.215" src_port="443" dst_port="49967"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="74.121.118.53" dst_ip="163.95.61.43" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="93.169.159.85" src_port="58022"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87908,1.31738,503,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="23.25.35.134" dst_ip="133.114.3.232"/>
            <filter src_ip="23.25.35.134" src_port="80"/>
            <filter dst_ip="133.114.3.232" dst_port="25"/>
            <filter src_ip="23.25.35.247" dst_ip="133.114.3.232" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.36674,1.40914,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="104.182.1.237" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.36674,1.40914,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="172.191.234.114" src_port="443"/>
            <filter dst_ip="163.95.62.143" src_port="443"/>
            <filter src_ip="8.239.244.23" dst_ip="163.95.62.143" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902598,1.34373,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.95.245.83" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.35133,1.38404,503,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="17.58.73.198" dst_port="443"/>
            <filter src_ip="163.95.146.107" dst_ip="17.58.73.198" dst_port="80"/>
            <filter src_ip="163.95.146.107" dst_ip="17.94.57.76" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
