<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="anomalous" value="2.69148,1.81429,010,1 1 1 1 1 1 1 1 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="123.254.209.190" dst_port="3306"/>
            <filter src_ip="213.32.24.78" dst_port="22"/>
            <filter src_ip="42.244.135.146" src_port="64148" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.96076,1.58756,010,1 1 1 1 1 1 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="208.157.104.172" dst_port="443"/>
        </slice>
        <from usec="0" sec="1496725601"/>
        <to usec="0" sec="1496725603"/>
    </anomaly>
    <anomaly type="anomalous" value="2.25252,1.60129,010,1 1 1 1 1 1 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="221.2.43.3" src_port="9090" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4269,1.61377,504,1 1 0 1 1 1 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.72.33.142" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.49585,1.30646,504,0 0 0 1 1 1 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="163.33.251.230" src_port="443"/>
            <filter src_ip="157.1.241.251" dst_ip="202.72.33.31" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.37068,1.3282,020,0 0 0 1 1 1 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="188.38.73.45"/>
        </slice>
        <from usec="0" sec="1496725200"/>
        <to usec="0" sec="1496725398"/>
    </anomaly>
    <anomaly type="anomalous" value="1.37068,1.3282,504,0 0 0 1 1 1 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.33.150.147" src_port="443"/>
        </slice>
        <from usec="0" sec="1496725205"/>
        <to usec="0" sec="1496725395"/>
    </anomaly>
    <anomaly type="anomalous" value="1.37068,1.3282,504,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="173.98.48.22" dst_ip="163.33.250.205" src_port="443" dst_port="52466"/>
            <filter src_ip="173.98.48.22" dst_ip="163.33.250.205" src_port="443" dst_port="52465"/>
            <filter src_ip="173.98.48.22" dst_ip="163.33.250.205" src_port="443" dst_port="52463"/>
        </slice>
        <from usec="0" sec="1496725334"/>
        <to usec="0" sec="1496725396"/>
    </anomaly>
    <anomaly type="anomalous" value="1.37068,1.3282,504,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="202.230.98.125" dst_ip="52.121.99.94" dst_port="443"/>
        </slice>
        <from usec="0" sec="1496725209"/>
        <to usec="0" sec="1496725487"/>
    </anomaly>
    <anomaly type="anomalous" value="1.37068,1.3282,010,0 0 0 1 1 1 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="103.5.186.128" dst_port="554"/>
        </slice>
        <from usec="0" sec="1496725202"/>
        <to usec="0" sec="1496725758"/>
    </anomaly>
    <anomaly type="anomalous" value="1.66203,1.30076,502,1 0 0 1 1 1 1 1 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="103.240.219.130" src_port="22"/>
            <filter dst_ip="221.2.43.3" src_port="22" dst_port="9090"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.66203,1.30076,503,1 0 0 1 1 1 1 1 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.77.15.105" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.69365,1.58232,999,1 1 1 1 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.77.1.57" dst_port="53"/>
            <filter dst_ip="203.77.14.122" dst_port="53"/>
        </slice>
        <from usec="0" sec="1496725290"/>
        <to usec="0" sec="1496725348"/>
    </anomaly>
    <anomaly type="anomalous" value="1.77422,1.54268,504,1 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="133.3.170.37" dst_ip="107.246.28.200" src_port="56220" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.19265,1.57226,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.77.15.105" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.19265,1.57226,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="23.220.145.97" src_port="80"/>
            <filter dst_ip="163.33.65.8" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.23858,2.67798,504,1 0 0 1 1 0 1 1 1 1 1 0,mptp">
        <slice>
            <filter dst_ip="202.230.98.125" src_port="443"/>
            <filter dst_ip="202.230.98.125" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.30922,1.56752,504,1 0 0 1 1 1 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.72.33.31" src_port="443"/>
            <filter dst_ip="202.72.33.31" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.41616,1.36486,503,1 1 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="133.3.165.98" dst_ip="37.57.128.92" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4269,1.61377,504,1 1 0 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="202.65.193.187"/>
            <filter src_ip="202.72.33.31" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.51389,1.27616,504,1 0 0 1 1 1 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="54.57.8.107" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.85756,2.96133,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="115.164.88.132" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.75885,1.56784,999,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.77.2.201" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.4596,1.58318,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="91.59.22.11" dst_port="22"/>
        </slice>
        <from usec="0" sec="1496726026"/>
        <to usec="0" sec="1496726059"/>
    </anomaly>
    <anomaly type="suspicious" value="1.4596,1.58318,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="62.141.250.109" src_port="5065" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1496725224"/>
        <to usec="0" sec="1496725256"/>
    </anomaly>
    <anomaly type="suspicious" value="1.4596,1.58318,999,1 1 1 0 0 0 0 0 0 0 0 0,ipv4gretun">
        <slice>
            <filter src_ip="203.77.15.240" dst_ip="206.177.91.17"/>
            <filter src_ip="203.77.15.240" dst_ip="204.61.126.254"/>
        </slice>
        <from usec="0" sec="1496725633"/>
        <to usec="0" sec="1496726026"/>
    </anomaly>
    <anomaly type="suspicious" value="1.4596,1.58318,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="163.33.227.70" dst_port="443"/>
            <filter src_ip="163.33.227.70" dst_ip="61.249.87.159" dst_port="80"/>
        </slice>
        <from usec="0" sec="1496725302"/>
        <to usec="0" sec="1496725313"/>
    </anomaly>
    <anomaly type="suspicious" value="1.4596,1.58318,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="42.79.118.37"/>
        </slice>
        <from usec="0" sec="1496726011"/>
        <to usec="0" sec="1496726013"/>
    </anomaly>
    <anomaly type="suspicious" value="1.4596,1.58318,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="210.148.145.190" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1496725688"/>
        <to usec="0" sec="1496725705"/>
    </anomaly>
    <anomaly type="suspicious" value="0.911084,1.31565,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1496725200"/>
        <to usec="0" sec="1496726028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.911084,1.31565,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1496725200"/>
        <to usec="0" sec="1496726028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04766,1.29028,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.33.209.46" dst_ip="198.220.233.252" dst_port="443"/>
            <filter src_ip="163.33.209.46" dst_ip="54.80.45.93" dst_port="443"/>
        </slice>
        <from usec="0" sec="1496725200"/>
        <to usec="0" sec="1496725668"/>
    </anomaly>
    <anomaly type="suspicious" value="0.97251,1.35996,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1496725200"/>
        <to usec="0" sec="1496726028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.950066,1.32193,999,0 0 0 1 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.3.229.137" dst_ip="89.177.131.125" src_port="587"/>
        </slice>
        <from usec="0" sec="1496725200"/>
        <to usec="0" sec="1496725668"/>
    </anomaly>
    <anomaly type="suspicious" value="0.950066,1.32193,504,0 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.77.7.73" src_port="443"/>
        </slice>
        <from usec="0" sec="1496725213"/>
        <to usec="0" sec="1496725393"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02381,1.29541,503,1 0 0 0 0 0 1 1 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.77.5.223" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.956065,1.35265,020,1 1 0 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="207.93.21.138"/>
        </slice>
        <from usec="0" sec="1496725740"/>
        <to usec="0" sec="1496725786"/>
    </anomaly>
    <anomaly type="suspicious" value="0.996949,1.32527,503,0 0 0 0 0 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter src_ip="172.57.230.98" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18062,1.3394,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="203.77.2.201" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18062,1.3394,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.33.77.139" src_port="443"/>
            <filter src_ip="8.240.23.203" dst_ip="163.33.77.139" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18062,1.3394,999,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="163.33.239.181" src_port="6881"/>
            <filter dst_ip="163.33.239.181" dst_port="6881"/>
            <filter src_port="6881" dst_port="6881"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18062,1.3394,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.33.250.200" src_port="443"/>
            <filter dst_ip="163.33.250.200" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18062,1.3394,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.33.33.232" src_port="443"/>
            <filter dst_ip="163.33.33.232" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
