<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="suspicious" value="1.115,1.21794,503,1 0 0 0 0 0 0 0 0 0 0 1,alphflHTTP">
        <slice>
            <filter src_ip="163.29.239.130" dst_ip="8.130.79.173" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,504,1 1 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="163.29.131.153" dst_port="443"/>
            <filter dst_ip="204.113.229.247" dst_port="443"/>
        </slice>
        <from usec="0" sec="1510376428"/>
        <to usec="0" sec="1510376991"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08978,1.12586,503,1 1 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="202.211.95.51" dst_port="443"/>
            <filter src_ip="202.211.95.51" dst_port="80"/>
        </slice>
        <from usec="0" sec="1510376405"/>
        <to usec="0" sec="1510377136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.8034,1.00236,504,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter src_ip="203.77.132.68" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.8034,1.00236,504,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="163.29.131.80" dst_port="443"/>
            <filter dst_ip="111.157.98.33" dst_port="443"/>
            <filter dst_ip="111.157.98.34" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.993731,1.19055,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="133.247.221.12" src_port="53"/>
            <filter src_ip="163.83.192.55" dst_ip="133.247.221.12" dst_port="53"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376446"/>
    </anomaly>
    <anomaly type="suspicious" value="0.839197,1.04218,502,1 0 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="203.77.133.39"/>
            <filter src_ip="192.143.116.64" dst_ip="203.77.133.37" dst_port="53"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510377136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.839197,1.04218,504,1 0 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter src_ip="163.29.243.227" dst_ip="202.219.3.87"/>
            <filter src_ip="163.29.243.227" dst_port="80"/>
            <filter src_ip="163.29.129.184" dst_ip="202.219.3.87"/>
            <filter src_ip="163.29.129.184" dst_port="80"/>
            <filter dst_ip="202.219.3.87" dst_port="80"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376876"/>
    </anomaly>
    <anomaly type="suspicious" value="0.8034,1.00236,010,1 0 0 0 0 0 0 0 0 1 1 0,sptpDoSSYN">
        <slice>
            <filter src_ip="163.29.129.170" dst_ip="54.181.181.151" dst_port="55"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,504,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.24.188.2" dst_port="443"/>
        </slice>
        <from usec="0" sec="1510376444"/>
        <to usec="0" sec="1510377035"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="163.29.129.212"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510377184"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.29.150.98" dst_ip="192.224.1.102" src_port="55493" dst_port="443"/>
        </slice>
        <from usec="0" sec="1510376751"/>
        <to usec="0" sec="1510376769"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06246,1.08911,504,1 1 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="184.208.47.134" dst_ip="163.29.66.77" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="213.80.140.131" dst_ip="203.77.139.208" dst_port="53"/>
            <filter src_ip="213.80.140.131" dst_ip="203.77.139.193" dst_port="53"/>
        </slice>
        <from usec="0" sec="1510376401"/>
        <to usec="0" sec="1510377200"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="133.24.113.124" dst_ip="67.158.182.144" dst_port="80"/>
        </slice>
        <from usec="0" sec="1510376512"/>
        <to usec="0" sec="1510377189"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="118.187.3.73" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376403"/>
        <to usec="0" sec="1510376477"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,502,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="221.177.174.29" dst_port="22"/>
        </slice>
        <from usec="0" sec="1510376568"/>
        <to usec="0" sec="1510377288"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="73.2.97.202" dst_ip="202.218.162.17" dst_port="19"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510377300"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.211.89.165" src_port="25"/>
            <filter dst_ip="202.211.89.165" dst_port="25"/>
        </slice>
        <from usec="0" sec="1510376427"/>
        <to usec="0" sec="1510377123"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.29.3.22" dst_port="25"/>
        </slice>
        <from usec="0" sec="1510376687"/>
        <to usec="0" sec="1510377082"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="45.83.52.85"/>
        </slice>
        <from usec="0" sec="1510376892"/>
        <to usec="0" sec="1510376894"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842614,1.07138,020,0 1 0 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="111.205.45.20"/>
        </slice>
        <from usec="0" sec="1510376485"/>
        <to usec="0" sec="1510376487"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="61.39.34.75" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376644"/>
        <to usec="0" sec="1510376685"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.108.149.212"/>
        </slice>
        <from usec="0" sec="1510376952"/>
        <to usec="0" sec="1510376954"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="50.172.234.83"/>
        </slice>
        <from usec="0" sec="1510376951"/>
        <to usec="0" sec="1510376953"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="158.141.249.130" src_port="18534" dst_port="5038"/>
        </slice>
        <from usec="0" sec="1510376660"/>
        <to usec="0" sec="1510376661"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="107.42.167.220"/>
        </slice>
        <from usec="0" sec="1510376478"/>
        <to usec="0" sec="1510376480"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="191.232.53.250" dst_port="445"/>
            <filter src_ip="191.232.53.250" dst_port="139"/>
        </slice>
        <from usec="0" sec="1510376844"/>
        <to usec="0" sec="1510376885"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.47.123.210" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376981"/>
        <to usec="0" sec="1510377021"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="223.226.77.198" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376584"/>
        <to usec="0" sec="1510376658"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="223.233.159.62" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376616"/>
        <to usec="0" sec="1510376671"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="175.255.159.193" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510377264"/>
        <to usec="0" sec="1510377284"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.61.249.114" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510377223"/>
        <to usec="0" sec="1510377296"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="159.138.210.99"/>
        </slice>
        <from usec="0" sec="1510376731"/>
        <to usec="0" sec="1510376733"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.62.86.168" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376994"/>
        <to usec="0" sec="1510377068"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="175.252.189.96" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376679"/>
        <to usec="0" sec="1510376732"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.202.60.115" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376853"/>
        <to usec="0" sec="1510376881"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="223.227.23.128" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376888"/>
        <to usec="0" sec="1510376909"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.212.84.244" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376994"/>
        <to usec="0" sec="1510377046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.42.202.27" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376556"/>
        <to usec="0" sec="1510376604"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="87.168.119.59" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376720"/>
        <to usec="0" sec="1510376741"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="175.247.110.184" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376715"/>
        <to usec="0" sec="1510376789"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="175.245.156.186" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376541"/>
        <to usec="0" sec="1510376599"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.63.27.54" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510377123"/>
        <to usec="0" sec="1510377179"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="118.186.240.222" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510377085"/>
        <to usec="0" sec="1510377133"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08978,1.12586,010,1 1 0 1 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="117.254.7.64" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376401"/>
        <to usec="0" sec="1510376508"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21448,1.23566,010,0 0 0 0 0 0 1 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="191.82.88.59" dst_port="8545"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="175.254.23.55" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376934"/>
        <to usec="0" sec="1510376972"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08978,1.12586,010,1 1 0 1 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="175.247.118.20" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376752"/>
        <to usec="0" sec="1510376810"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.211.63.160" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376505"/>
        <to usec="0" sec="1510376563"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="207.174.157.37"/>
        </slice>
        <from usec="0" sec="1510376840"/>
        <to usec="0" sec="1510377171"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="42.149.55.164"/>
        </slice>
        <from usec="0" sec="1510376544"/>
        <to usec="0" sec="1510377247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="191.84.0.127"/>
        </slice>
        <from usec="0" sec="1510377268"/>
        <to usec="0" sec="1510377269"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="155.159.224.135"/>
        </slice>
        <from usec="0" sec="1510376819"/>
        <to usec="0" sec="1510376821"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.92.224.220"/>
        </slice>
        <from usec="0" sec="1510377072"/>
        <to usec="0" sec="1510377137"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="185.61.2.238"/>
        </slice>
        <from usec="0" sec="1510376750"/>
        <to usec="0" sec="1510376753"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="146.4.243.225"/>
        </slice>
        <from usec="0" sec="1510377067"/>
        <to usec="0" sec="1510377090"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,504,1 1 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="163.29.150.245" dst_ip="54.241.123.43" src_port="51519" dst_port="443"/>
            <filter src_ip="163.29.150.245" dst_ip="54.241.123.43" src_port="50886" dst_port="443"/>
            <filter src_ip="133.24.141.236" dst_ip="54.241.123.43" src_port="51896" dst_port="443"/>
        </slice>
        <from usec="0" sec="1510376807"/>
        <to usec="0" sec="1510376810"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="203.77.146.4" dst_ip="117.206.20.196" dst_port="993"/>
            <filter src_ip="203.77.146.4" dst_ip="118.88.187.148" dst_port="993"/>
        </slice>
        <from usec="0" sec="1510376787"/>
        <to usec="0" sec="1510376867"/>
    </anomaly>
    <anomaly type="suspicious" value="1.24691,1.25153,010,1 1 1 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="185.35.32.227" src_port="55570" dst_port="23"/>
            <filter src_ip="185.35.32.227" src_port="55570" dst_port="2323"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,999,1 1 1 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="116.45.39.202" dst_port="123"/>
            <filter src_ip="61.48.247.194" dst_ip="202.211.89.177" dst_port="123"/>
        </slice>
        <from usec="0" sec="1510376406"/>
        <to usec="0" sec="1510376959"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter dst_ip="203.77.141.196" src_port="38481"/>
            <filter dst_ip="203.77.141.196" src_port="27100"/>
            <filter dst_ip="202.211.89.177" src_port="38481"/>
            <filter dst_ip="202.211.89.177" src_port="27100"/>
            <filter dst_ip="203.77.137.132" src_port="38481"/>
            <filter dst_ip="203.77.137.132" src_port="27100"/>
            <filter dst_ip="203.77.137.131" src_port="38481"/>
            <filter dst_ip="203.77.137.131" src_port="27100"/>
            <filter dst_ip="203.77.136.106" src_port="38481"/>
            <filter dst_ip="203.77.136.106" src_port="27100"/>
            <filter src_ip="45.196.165.56" dst_ip="203.77.141.196" dst_port="123"/>
            <filter src_ip="45.196.165.56" dst_ip="202.211.89.177" dst_port="123"/>
            <filter src_ip="45.196.165.56" dst_ip="203.77.137.132" dst_port="123"/>
            <filter src_ip="45.196.165.56" dst_ip="203.77.137.131" dst_port="123"/>
            <filter src_ip="45.196.165.56" dst_ip="203.77.136.106" dst_port="123"/>
            <filter src_ip="45.196.165.56" src_port="38481" dst_port="123"/>
            <filter src_ip="45.196.165.56" src_port="27100" dst_port="123"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376509"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="1.184.43.70" dst_ip="202.211.89.187" src_port="51402" dst_port="80"/>
            <filter src_ip="1.184.43.70" dst_ip="202.211.89.187" src_port="51401" dst_port="80"/>
            <filter src_ip="1.184.43.70" dst_ip="202.211.89.187" src_port="51400" dst_port="80"/>
            <filter src_ip="1.184.43.70" dst_ip="202.211.89.187" src_port="51398" dst_port="80"/>
        </slice>
        <from usec="0" sec="1510376527"/>
        <to usec="0" sec="1510376529"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="189.38.151.166" src_port="22" dst_port="35255"/>
        </slice>
        <from usec="0" sec="1510377105"/>
        <to usec="0" sec="1510377108"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.105.87.129"/>
        </slice>
        <from usec="0" sec="1510376470"/>
        <to usec="0" sec="1510376472"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="139.56.189.241"/>
        </slice>
        <from usec="0" sec="1510376825"/>
        <to usec="0" sec="1510376826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.24691,1.25153,999,1 1 1 0 0 0 0 0 0 1 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="146.4.243.225" src_port="20022" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.980195,1.17836,020,1 0 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="111.205.45.20"/>
        </slice>
        <from usec="0" sec="1510376485"/>
        <to usec="0" sec="1510377197"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="139.56.243.22"/>
        </slice>
        <from usec="0" sec="1510376718"/>
        <to usec="0" sec="1510376720"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="175.254.2.225" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376650"/>
        <to usec="0" sec="1510376708"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.43.203.129" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376902"/>
        <to usec="0" sec="1510376992"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20173,1.25298,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="101.167.103.120" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376972"/>
        <to usec="0" sec="1510377017"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376868"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510377228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,999,0 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.77.142.244"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376508"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="216.191.53.2"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376507"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="139.56.55.251"/>
        </slice>
        <from usec="0" sec="1510376401"/>
        <to usec="0" sec="1510376507"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,504,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="207.180.148.126"/>
        </slice>
        <from usec="0" sec="1510376401"/>
        <to usec="0" sec="1510376507"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="113.247.236.122"/>
        </slice>
        <from usec="0" sec="1510376403"/>
        <to usec="0" sec="1510376508"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="201.237.17.246"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376597"/>
    </anomaly>
    <anomaly type="suspicious" value="0.839197,1.04218,503,1 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="163.29.131.90" dst_port="80"/>
            <filter src_ip="163.29.131.90" dst_ip="34.13.32.179" dst_port="443"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510377279"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,020,0 0 0 1 0 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="202.218.144.84"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376688"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="94.129.174.43"/>
        </slice>
        <from usec="0" sec="1510376401"/>
        <to usec="0" sec="1510376682"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,504,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="184.225.87.231"/>
        </slice>
        <from usec="0" sec="1510376412"/>
        <to usec="0" sec="1510376645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.29.130.80"/>
        </slice>
        <from usec="0" sec="1510376415"/>
        <to usec="0" sec="1510376653"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,504,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="104.236.227.105"/>
        </slice>
        <from usec="0" sec="1510376474"/>
        <to usec="0" sec="1510376654"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="52.153.143.34"/>
        </slice>
        <from usec="0" sec="1510376516"/>
        <to usec="0" sec="1510376651"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="104.235.150.255"/>
        </slice>
        <from usec="0" sec="1510376686"/>
        <to usec="0" sec="1510376687"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,010,0 0 0 1 0 0 0 0 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="116.41.144.178"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376778"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="163.29.65.97"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376776"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="122.172.161.111"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376773"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="202.211.89.161"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376727"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="178.104.38.109"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376768"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="175.242.88.19"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376777"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.24.9.177"/>
        </slice>
        <from usec="0" sec="1510376401"/>
        <to usec="0" sec="1510376776"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="61.254.224.121"/>
        </slice>
        <from usec="0" sec="1510376401"/>
        <to usec="0" sec="1510376778"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="186.39.187.132"/>
        </slice>
        <from usec="0" sec="1510376401"/>
        <to usec="0" sec="1510376778"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="39.102.176.18"/>
        </slice>
        <from usec="0" sec="1510376402"/>
        <to usec="0" sec="1510376778"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="106.70.186.172"/>
        </slice>
        <from usec="0" sec="1510376402"/>
        <to usec="0" sec="1510376778"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="74.162.11.156"/>
        </slice>
        <from usec="0" sec="1510376404"/>
        <to usec="0" sec="1510376773"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="117.146.222.223"/>
        </slice>
        <from usec="0" sec="1510376420"/>
        <to usec="0" sec="1510376775"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.77.138.204"/>
        </slice>
        <from usec="0" sec="1510376457"/>
        <to usec="0" sec="1510376669"/>
    </anomaly>
    <anomaly type="suspicious" value="0.839197,1.04218,504,1 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.77.138.204" dst_port="443"/>
            <filter dst_ip="203.77.138.204" dst_port="80"/>
        </slice>
        <from usec="0" sec="1510376655"/>
        <to usec="0" sec="1510376661"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,504,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="23.40.210.59"/>
        </slice>
        <from usec="0" sec="1510376719"/>
        <to usec="0" sec="1510376765"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="114.25.174.238"/>
        </slice>
        <from usec="0" sec="1510376740"/>
        <to usec="0" sec="1510376778"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,503,0 0 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.29.248.156" src_port="80"/>
            <filter dst_ip="163.29.248.156" src_port="443"/>
        </slice>
        <from usec="0" sec="1510376417"/>
        <to usec="0" sec="1510376957"/>
    </anomaly>
    <anomaly type="suspicious" value="0.993731,1.19055,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.51.241.161"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376446"/>
    </anomaly>
    <anomaly type="suspicious" value="0.993731,1.19055,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.51.241.177"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376446"/>
    </anomaly>
    <anomaly type="suspicious" value="0.993731,1.19055,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.11.189.177"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376446"/>
    </anomaly>
    <anomaly type="suspicious" value="0.993731,1.19055,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="77.71.240.221"/>
        </slice>
        <from usec="0" sec="1510376490"/>
        <to usec="0" sec="1510376536"/>
    </anomaly>
    <anomaly type="suspicious" value="0.993731,1.19055,010,0 0 0 0 0 0 1 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_port="6666" dst_port="22"/>
        </slice>
        <from usec="0" sec="1510376490"/>
        <to usec="0" sec="1510376536"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958581,1.16029,999,1 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.77.130.122" dst_port="53"/>
        </slice>
        <from usec="0" sec="1510376534"/>
        <to usec="0" sec="1510376581"/>
    </anomaly>
    <anomaly type="suspicious" value="0.993731,1.19055,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="106.123.114.232" dst_port="8888"/>
        </slice>
        <from usec="0" sec="1510376760"/>
        <to usec="0" sec="1510376806"/>
    </anomaly>
    <anomaly type="suspicious" value="0.993731,1.19055,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="77.71.240.80" src_port="53111"/>
        </slice>
        <from usec="0" sec="1510376850"/>
        <to usec="0" sec="1510376896"/>
    </anomaly>
    <anomaly type="suspicious" value="0.993731,1.19055,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.24.227.185"/>
        </slice>
        <from usec="0" sec="1510376850"/>
        <to usec="0" sec="1510376896"/>
    </anomaly>
    <anomaly type="suspicious" value="0.993731,1.19055,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="191.82.88.59"/>
        </slice>
        <from usec="0" sec="1510376850"/>
        <to usec="0" sec="1510376896"/>
    </anomaly>
    <anomaly type="suspicious" value="0.993731,1.19055,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.29.130.1"/>
        </slice>
        <from usec="0" sec="1510376850"/>
        <to usec="0" sec="1510376896"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958581,1.16029,999,1 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.77.129.188" dst_port="53"/>
        </slice>
        <from usec="0" sec="1510376455"/>
        <to usec="0" sec="1510376896"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22999,1.23453,010,1 1 0 0 0 0 1 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="185.191.116.168" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.993731,1.19055,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="216.97.239.36" src_port="65534" dst_port="8545"/>
            <filter src_ip="216.97.239.36" src_port="65535" dst_port="8545"/>
        </slice>
        <from usec="0" sec="1510376940"/>
        <to usec="0" sec="1510376986"/>
    </anomaly>
    <anomaly type="suspicious" value="0.993731,1.19055,010,0 0 0 0 0 0 1 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_port="6666" dst_port="80"/>
        </slice>
        <from usec="0" sec="1510377075"/>
        <to usec="0" sec="1510377121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.01465,1.15872,010,1 0 0 0 0 0 1 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="130.83.97.147" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.8034,1.00236,002,1 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="124.64.242.18" dst_ip="133.247.47.195" dst_port="137"/>
            <filter src_ip="124.64.242.18" dst_ip="133.247.47.195" dst_port="138"/>
            <filter src_ip="124.64.242.18" dst_ip="133.247.36.127" dst_port="137"/>
            <filter src_ip="124.64.242.18" dst_ip="133.247.36.127" dst_port="138"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.8034,1.00236,999,1 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="202.218.165.237" dst_port="111"/>
            <filter src_ip="58.202.150.51" dst_ip="202.218.165.237" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939951,1.07407,010,0 0 0 1 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="139.56.51.238" dst_port="1755"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.867183,1.03589,503,1 1 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.195.112.102" dst_ip="203.77.142.139" dst_port="80"/>
            <filter src_ip="169.195.112.102" dst_ip="203.77.142.145" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.8034,1.00236,999,1 0 0 0 0 0 0 0 0 1 1 0,ntscUDPOther">
        <slice>
            <filter src_ip="195.103.31.4" src_port="5073" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.8034,1.00236,504,1 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="209.173.229.179" dst_ip="163.29.130.58" src_port="443" dst_port="64846"/>
            <filter src_ip="209.173.229.179" dst_ip="163.29.130.58" src_port="443" dst_port="50501"/>
            <filter src_ip="74.162.165.84" dst_ip="163.29.130.58" src_port="443" dst_port="51115"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902709,1.04043,504,1 0 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="202.218.158.242" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.8034,1.00236,999,1 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="203.168.143.253" dst_ip="149.236.4.68" src_port="161"/>
            <filter src_ip="203.168.143.253" dst_ip="199.0.126.141" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21448,1.23566,010,0 0 0 0 0 0 1 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="136.143.70.181" src_port="110"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.8034,1.00236,503,1 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="189.235.91.223" dst_ip="163.29.6.238" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.800859,1.03765,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="74.162.168.250" dst_ip="163.29.67.194" src_port="443" dst_port="39704"/>
            <filter src_ip="74.162.168.250" dst_ip="163.29.67.194" src_port="443" dst_port="35660"/>
        </slice>
        <from usec="0" sec="1510377104"/>
        <to usec="0" sec="1510377106"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,504,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="172.102.153.242" dst_ip="163.29.233.46" src_port="443"/>
        </slice>
        <from usec="0" sec="1510376410"/>
        <to usec="0" sec="1510376507"/>
    </anomaly>
    <anomaly type="suspicious" value="1.115,1.21794,504,1 0 0 0 0 0 0 0 0 0 0 1,mptp">
        <slice>
            <filter dst_ip="163.29.131.89" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="117.233.40.75" src_port="443"/>
            <filter dst_ip="163.29.131.194" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04792,1.18903,010,0 0 0 0 0 0 1 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="191.82.88.59" dst_port="8545"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,999,0 0 0 0 0 0 0 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.77.132.68" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.8034,1.00236,504,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="87.97.40.253" dst_ip="202.211.95.211"/>
            <filter src_ip="87.97.40.253" dst_port="443"/>
            <filter src_ip="121.161.1.48" dst_ip="202.211.95.211" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="163.29.231.241" src_port="80"/>
            <filter src_ip="163.29.207.134" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="117.212.204.29" src_port="52413" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="120.155.77.57"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="128.136.35.76" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,020,0 0 0 0 0 0 0 0 0 1 1 0,icmp_error">
        <slice>
            <filter src_ip="133.24.104.5"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.8034,1.00236,054,1 0 0 0 0 0 0 0 0 1 1 0,point_to_point">
        <slice>
            <filter src_ip="163.29.131.81" dst_ip="94.249.97.172" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="163.29.239.182" dst_ip="213.64.117.190" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21448,1.23566,010,0 0 0 0 0 0 1 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="169.201.229.129" src_port="6666" dst_port="27017"/>
            <filter src_ip="169.201.229.129" src_port="6666" dst_port="2323"/>
            <filter src_ip="169.201.229.129" src_port="6712" dst_port="4500"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.8034,1.00236,504,1 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="182.112.245.142" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="178.193.40.234" dst_ip="163.29.150.233" src_port="443" dst_port="51723"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,010,0 0 0 0 0 0 0 0 0 1 1 0,DDoSSYNACKrp">
        <slice>
            <filter src_ip="183.2.95.26" src_port="7021"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.8034,1.00236,010,1 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="192.63.154.166" src_port="61234" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="198.55.137.41" dst_ip="163.29.130.241" src_port="443"/>
            <filter src_ip="198.55.137.41" dst_ip="163.29.130.82" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,020,0 0 0 0 0 0 0 0 0 1 1 0,ttl_error">
        <slice>
            <filter src_ip="202.218.152.121"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="202.33.182.146" src_port="26610" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="203.77.129.180" src_port="443"/>
            <filter src_ip="203.77.129.180" dst_ip="186.140.205.23" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,020,0 0 0 0 0 0 0 0 0 1 1 0,hostout">
        <slice>
            <filter src_ip="203.77.139.108"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="209.173.228.253" dst_ip="163.29.150.191" src_port="443" dst_port="54323"/>
            <filter src_ip="209.173.228.253" dst_ip="163.29.150.191" src_port="443" dst_port="54322"/>
            <filter src_ip="209.173.228.253" dst_ip="163.29.150.191" src_port="443" dst_port="54321"/>
            <filter src_ip="209.173.228.253" dst_ip="163.29.150.191" src_port="443" dst_port="54320"/>
            <filter src_ip="209.173.228.253" dst_ip="163.29.150.191" src_port="443" dst_port="53356"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="212.76.39.76" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="35.95.206.60" dst_ip="163.29.131.211" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="37.237.232.212" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="52.250.184.42" dst_ip="163.29.130.77" src_port="443" dst_port="6128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,010,0 0 0 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="60.94.216.125" dst_port="554"/>
            <filter src_ip="60.94.216.125" dst_port="37777"/>
            <filter src_ip="60.94.216.125" dst_port="8000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="62.51.21.126" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="66.81.71.68" src_port="43780" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.8034,1.00236,504,1 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="74.162.168.216" dst_ip="163.29.130.18" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="74.162.243.56" dst_ip="163.29.130.120" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="74.162.172.119" dst_ip="163.29.130.204" src_port="443" dst_port="59572"/>
            <filter src_ip="74.162.172.119" dst_ip="163.29.130.204" src_port="443" dst_port="59571"/>
            <filter src_ip="74.162.172.119" dst_ip="163.29.130.204" src_port="443" dst_port="59558"/>
            <filter src_ip="74.162.172.119" dst_ip="163.29.130.204" src_port="443" dst_port="59557"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="78.106.98.100" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="202.218.165.237" dst_ip="122.76.129.105" src_port="111"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,502,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="203.77.134.178" dst_ip="129.192.99.214" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,010,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="133.11.191.206" dst_port="50348"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,010,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="150.51.147.94" dst_port="54748"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="108.201.66.240" dst_ip="163.29.131.117" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="211.2.31.10" dst_ip="163.29.131.227" src_port="80"/>
            <filter src_ip="211.2.31.13" dst_ip="163.29.131.227" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.29.130.174" src_port="443"/>
            <filter dst_ip="163.29.130.174" src_port="3074" dst_port="3074"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="38.169.162.82" dst_ip="163.29.129.182" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,999,0 0 0 0 0 0 0 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.29.32.95" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="133.24.93.213" dst_ip="199.159.177.227" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="163.29.130.138" dst_ip="208.160.212.114" src_port="48173" dst_port="443"/>
            <filter src_ip="163.29.130.138" dst_ip="208.160.212.114" src_port="48106" dst_port="443"/>
            <filter src_ip="163.29.130.138" dst_ip="208.160.212.114" src_port="48085" dst_port="443"/>
            <filter src_ip="163.29.130.138" dst_ip="208.160.212.114" src_port="48084" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="202.218.176.116" dst_ip="219.128.94.94" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="203.77.147.235" dst_port="80"/>
            <filter src_ip="202.211.93.137" dst_ip="202.37.60.28" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.8034,1.00236,504,1 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="133.24.98.49" dst_ip="52.135.53.88" src_port="39261" dst_port="443"/>
            <filter src_ip="133.24.98.48" dst_ip="52.135.53.88" src_port="40295" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="74.162.168.36" dst_ip="163.29.129.216" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.84503,1.03724,504,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter src_ip="95.232.192.161" src_port="61234" dst_port="7547"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.879134,1.07576,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="172.102.153.241" src_port="443"/>
        </slice>
        <from usec="0" sec="1510376626"/>
        <to usec="0" sec="1510376688"/>
    </anomaly>
    <anomaly type="suspicious" value="1.19268,1.24534,504,0 0 0 0 0 0 0 0 0 1 0 1,mptmp">
        <slice>
            <filter src_ip="23.41.211.239" src_port="443"/>
            <filter src_ip="74.162.90.75" dst_ip="163.29.131.180"/>
            <filter src_ip="74.162.90.75" src_port="443"/>
            <filter dst_ip="163.29.131.180" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.48797,1.33201,999,1 1 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.77.138.177" dst_port="123"/>
            <filter dst_ip="203.77.139.243" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.21639,1.83497,503,1 1 0 1 0 0 1 1 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="202.211.95.51" dst_port="443"/>
            <filter src_ip="202.211.95.51" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.21639,1.83497,504,1 1 0 1 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.218.176.63" src_port="443"/>
            <filter dst_ip="202.211.95.51" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.38982,1.29592,999,1 1 1 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="47.90.170.147" dst_port="123"/>
            <filter dst_ip="203.77.137.131" dst_port="123"/>
            <filter dst_ip="203.77.141.196" dst_port="123"/>
            <filter dst_ip="203.77.136.106" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.28472,1.81793,504,1 1 0 1 1 1 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="162.98.213.1" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.48797,1.33201,503,1 1 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="61.123.199.233" dst_ip="202.211.95.51" src_port="80" dst_port="50758"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.77261,2.25626,999,1 1 1 1 1 1 1 1 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="23.240.234.53" src_port="50827" dst_port="389"/>
        </slice>
        <from usec="0" sec="1510376490"/>
        <to usec="0" sec="1510376536"/>
    </anomaly>
    <anomaly type="anomalous" value="1.67136,1.5744,999,1 1 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="219.126.181.124" dst_ip="202.211.89.191" dst_port="993"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510377032"/>
    </anomaly>
    <anomaly type="anomalous" value="1.7369,1.50582,504,1 1 1 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="202.36.204.228" dst_ip="163.29.129.249" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.66142,1.40182,504,1 1 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.29.6.224" dst_port="80"/>
            <filter dst_ip="163.29.6.224" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.81132,1.60878,503,1 1 0 0 0 0 1 1 0 1 1 0,heavy_hitter">
        <slice>
            <filter src_ip="203.51.143.251" dst_ip="203.77.132.111" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.55359,2.04465,503,1 1 0 1 1 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.77.147.235" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.65821,2.08422,999,1 1 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="185.159.81.241" dst_port="111"/>
            <filter src_ip="136.143.70.181" src_port="110"/>
            <filter src_ip="92.216.39.123" src_port="8718" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.60681,1.46084,010,1 1 1 0 0 0 1 0 0 0 1 0,ntscSYN">
        <slice>
            <filter src_ip="189.38.151.166" src_port="17029" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.48494,1.42161,010,1 1 1 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="190.97.114.232" dst_port="80"/>
            <filter src_ip="190.97.114.232" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1510376447"/>
        <to usec="0" sec="1510376550"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35466,1.33413,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376868"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35466,1.33413,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510377228"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54316,1.40384,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.77.139.197" src_port="53"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376598"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54316,1.40384,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="42.74.44.246" src_port="37235" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376402"/>
        <to usec="0" sec="1510376687"/>
    </anomaly>
    <anomaly type="anomalous" value="2.07792,1.75645,010,0 0 0 1 1 1 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="113.53.71.65" dst_port="22"/>
        </slice>
        <from usec="0" sec="1510376401"/>
        <to usec="0" sec="1510377033"/>
    </anomaly>
    <anomaly type="anomalous" value="2.07792,1.75645,999,0 0 0 1 1 1 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="203.77.137.213" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1510376407"/>
        <to usec="0" sec="1510377039"/>
    </anomaly>
    <anomaly type="anomalous" value="2.06134,1.73609,010,1 0 0 1 1 1 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="185.219.86.0" src_port="53087" dst_port="445"/>
        </slice>
        <from usec="0" sec="1510376947"/>
        <to usec="0" sec="1510377048"/>
    </anomaly>
    <anomaly type="anomalous" value="2.07792,1.75645,999,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="60.115.230.199" dst_ip="163.29.130.210" src_port="57555" dst_port="63472"/>
        </slice>
        <from usec="0" sec="1510377020"/>
        <to usec="0" sec="1510377048"/>
    </anomaly>
    <anomaly type="anomalous" value="2.07792,1.75645,504,0 0 0 1 1 1 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="163.29.150.155" dst_ip="35.64.23.95" dst_port="443"/>
        </slice>
        <from usec="0" sec="1510376404"/>
        <to usec="0" sec="1510377218"/>
    </anomaly>
    <anomaly type="anomalous" value="2.07792,1.75645,010,0 0 0 1 1 1 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="177.31.19.58" src_port="63619" dst_port="23"/>
            <filter src_ip="177.31.19.58" src_port="3535" dst_port="23"/>
        </slice>
        <from usec="0" sec="1510376421"/>
        <to usec="0" sec="1510377225"/>
    </anomaly>
    <anomaly type="anomalous" value="2.07792,1.75645,999,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.77.137.218" dst_ip="72.161.171.219"/>
        </slice>
        <from usec="0" sec="1510377058"/>
        <to usec="0" sec="1510377228"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47072,1.4425,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376688"/>
    </anomaly>
    <anomaly type="anomalous" value="2.41284,1.92653,010,1 0 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="185.187.12.88" src_port="57236"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47072,1.4425,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376868"/>
    </anomaly>
    <anomaly type="anomalous" value="2.07792,1.75645,504,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="52.231.188.195" dst_ip="163.29.130.77" src_port="443"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510377048"/>
    </anomaly>
    <anomaly type="anomalous" value="2.07792,1.75645,504,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="208.160.212.112" dst_ip="163.29.130.138" src_port="443" dst_port="56885"/>
            <filter src_ip="208.160.212.112" dst_ip="163.29.130.138" src_port="443" dst_port="56880"/>
            <filter src_ip="208.160.212.112" dst_ip="163.29.130.138" src_port="443" dst_port="56831"/>
            <filter src_ip="208.160.212.112" dst_ip="163.29.130.138" src_port="443" dst_port="56830"/>
        </slice>
        <from usec="0" sec="1510376554"/>
        <to usec="0" sec="1510377000"/>
    </anomaly>
    <anomaly type="anomalous" value="1.51989,1.51569,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="133.247.221.12" src_port="53"/>
            <filter src_ip="163.83.192.55" dst_ip="133.247.221.12" dst_port="53"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376896"/>
    </anomaly>
    <anomaly type="anomalous" value="2.8238,2.26132,504,1 0 0 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.211.95.140" src_port="443"/>
            <filter dst_ip="202.211.95.51" src_port="443"/>
            <filter dst_ip="202.211.95.51" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.51989,1.51569,999,1 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.77.147.235" dst_port="53"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376677"/>
    </anomaly>
    <anomaly type="anomalous" value="1.51989,1.51569,503,1 0 0 0 0 0 1 1 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="219.116.151.96" dst_ip="202.211.95.10" dst_port="80"/>
            <filter src_ip="49.160.239.158" dst_ip="202.211.95.10" dst_port="80"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376674"/>
    </anomaly>
    <anomaly type="anomalous" value="1.51989,1.51569,999,1 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="192.195.119.7" dst_ip="203.77.133.37" src_port="53"/>
        </slice>
        <from usec="0" sec="1510376490"/>
        <to usec="0" sec="1510377106"/>
    </anomaly>
    <anomaly type="anomalous" value="1.64088,1.45959,010,1 1 1 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="185.35.32.228" src_port="25911" dst_port="23"/>
            <filter src_ip="185.35.32.228" src_port="25911" dst_port="2323"/>
            <filter src_ip="222.215.0.96" src_port="42400" dst_port="10001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5423,1.53897,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.247.24.9" src_port="53"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5423,1.53897,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.29.104.14" dst_port="53"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5423,1.53897,504,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.29.129.253" src_port="443"/>
            <filter dst_ip="163.29.129.253" src_port="80"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5423,1.53897,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.77.139.213" dst_port="53"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5423,1.53897,504,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.29.131.222" src_port="443"/>
            <filter dst_ip="163.29.131.222" src_port="80"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.69297,1.57413,504,0 0 0 0 0 0 1 1 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.29.240.107" src_port="443"/>
            <filter dst_ip="163.29.240.107" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5423,1.53897,504,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="183.191.199.64" dst_ip="163.29.243.184" src_port="443"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5423,1.53897,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.218.152.69" src_port="53"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5423,1.53897,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.77.142.138" src_port="53"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5423,1.53897,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.77.129.188" dst_port="53"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5423,1.53897,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.51.240.170" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5423,1.53897,010,0 0 0 0 0 0 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="77.71.240.80" src_port="53111"/>
        </slice>
        <from usec="0" sec="1510377120"/>
        <to usec="0" sec="1510377166"/>
    </anomaly>
    <anomaly type="anomalous" value="2.41284,1.92653,504,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.29.131.72"/>
            <filter dst_ip="163.29.130.50" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.8286,1.6117,502,1 0 0 1 0 0 1 1 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="58.228.14.162" src_port="22"/>
            <filter dst_ip="189.38.151.166" src_port="22" dst_port="35255"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55586,1.51449,502,1 0 0 0 0 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="133.24.72.16" dst_ip="58.228.14.162"/>
            <filter src_ip="133.24.72.16" src_port="22"/>
            <filter dst_ip="58.228.14.162" src_port="22"/>
            <filter dst_ip="123.52.106.64" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.31555,1.26207,504,1 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="163.29.129.151" dst_port="80"/>
            <filter src_ip="163.29.129.151" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.57776,1.53779,999,0 0 0 0 0 0 1 1 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="163.29.33.101" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.66608,2.09433,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="202.117.103.243" src_port="47248" dst_port="10022"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5423,1.53897,504,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.29.129.203" src_port="80"/>
            <filter dst_ip="163.29.129.203" src_port="443"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.74229,1.59864,999,0 0 0 1 0 0 1 1 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.29.29.83" src_port="30303" dst_port="30303"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.70413,1.57324,999,1 1 0 0 0 0 1 1 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="61.187.159.22" dst_ip="202.12.252.243" dst_port="53"/>
            <filter src_ip="61.187.159.13" dst_ip="202.12.252.243" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.38982,1.29592,504,1 1 1 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="203.77.147.235" dst_ip="202.211.95.140" src_port="443"/>
            <filter src_ip="203.77.147.235" dst_ip="163.29.131.194" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34138,1.28995,999,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.77.130.196"/>
            <filter dst_ip="185.187.12.88" src_port="6050" dst_port="57236"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.35272,1.92059,999,1 1 1 1 1 1 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.187.0.67" src_port="36050" dst_port="123"/>
        </slice>
        <from usec="0" sec="1510376460"/>
        <to usec="0" sec="1510376465"/>
    </anomaly>
    <anomaly type="anomalous" value="1.57776,1.53779,010,0 0 0 0 0 0 1 1 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="133.11.189.246" dst_port="50356"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.57776,1.53779,010,0 0 0 0 0 0 1 1 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="150.51.240.181" dst_port="54756"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34138,1.28995,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.29.131.163" src_port="443"/>
            <filter dst_ip="163.29.130.55" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34138,1.28995,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="74.162.168.136" dst_ip="163.29.130.72" src_port="443" dst_port="52759"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.10437,1.75542,010,0 0 0 1 1 1 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="66.235.18.36"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.88761,1.56791,504,1 1 1 1 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="202.218.176.63" dst_port="53"/>
            <filter src_ip="202.218.176.63" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.57412,1.36757,010,1 1 1 1 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="112.174.50.106" dst_port="33893"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55586,1.51449,999,1 0 0 0 0 0 1 1 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.77.139.197" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.27411,1.80882,999,1 1 1 1 1 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.77.138.248" dst_ip="206.92.35.64"/>
            <filter src_ip="203.77.138.248" dst_ip="204.34.13.110"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.31555,1.26207,503,1 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.77.132.111" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.66608,2.09433,999,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.77.137.132" src_port="123"/>
            <filter src_ip="203.77.137.132" src_port="5060"/>
            <filter src_ip="203.77.137.131" src_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34138,1.28995,010,0 0 0 0 0 0 0 0 0 1 1 1,sntscSYN">
        <slice>
            <filter src_ip="139.56.61.99" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.07792,1.75645,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.29.248.156" src_port="80"/>
            <filter dst_ip="163.29.248.156" src_port="443"/>
        </slice>
        <from usec="0" sec="1510376417"/>
        <to usec="0" sec="1510377024"/>
    </anomaly>
    <anomaly type="anomalous" value="2.42702,1.94491,504,0 0 0 1 1 1 0 0 0 1 1 1,rflatUDP">
        <slice>
            <filter dst_ip="163.29.232.194" src_port="443"/>
            <filter src_ip="172.102.154.86" dst_ip="202.218.176.63" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34138,1.28995,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="173.141.12.126" dst_ip="163.29.129.170" src_port="443" dst_port="57146"/>
            <filter src_ip="173.141.12.126" dst_ip="163.29.129.170" src_port="443" dst_port="57145"/>
            <filter src_ip="173.141.12.126" dst_ip="163.29.129.170" src_port="443" dst_port="57113"/>
            <filter src_ip="173.141.12.126" dst_ip="163.29.129.170" src_port="443" dst_port="57112"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34138,1.28995,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.77.142.230" src_port="53"/>
            <filter dst_ip="203.77.142.230" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34138,1.28995,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="198.55.136.229" dst_ip="163.29.130.241" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34138,1.28995,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="49.160.233.63" dst_ip="202.211.95.51" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.53152,1.36191,504,0 0 0 1 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="74.162.165.11" dst_ip="163.29.130.18" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34138,1.28995,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="203.77.130.213" dst_ip="74.141.255.98"/>
            <filter src_ip="203.77.130.213"/>
            <filter src_ip="203.77.130.213"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.45413,1.94888,010,1 1 1 1 1 1 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="189.38.151.166" src_port="35255" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.97047,1.73056,504,1 0 0 0 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34138,1.28995,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.29.65.0" src_port="443"/>
            <filter dst_ip="163.29.129.233" src_port="443"/>
            <filter dst_ip="163.29.129.233" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.31555,1.26207,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.29.155.37" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34138,1.28995,010,0 0 0 0 0 0 0 0 0 1 1 1,sntscSYN">
        <slice>
            <filter src_ip="138.188.101.220" dst_port="49"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5423,1.53897,504,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.77.138.76" src_port="443"/>
            <filter dst_ip="203.77.138.76" src_port="80"/>
        </slice>
        <from usec="0" sec="1510376400"/>
        <to usec="0" sec="1510376446"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34138,1.28995,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="163.29.239.210" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.66608,2.09433,504,1 1 1 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="163.29.155.37" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.97114,1.61157,503,1 0 0 1 1 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.77.147.235" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34138,1.28995,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="162.98.143.247" src_port="443"/>
            <filter dst_ip="163.29.129.150" src_port="443"/>
            <filter dst_ip="163.29.237.128" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.31555,1.26207,504,1 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="163.29.130.174" src_port="17278"/>
            <filter src_ip="163.29.130.174" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34138,1.28995,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="203.77.142.139" dst_ip="169.195.112.102" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34138,1.28995,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="209.173.228.3" dst_ip="163.29.129.129" src_port="443" dst_port="36965"/>
            <filter src_ip="209.173.228.3" dst_ip="163.29.129.129" src_port="443" dst_port="36964"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.31555,1.26207,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="74.162.165.86" src_port="443"/>
            <filter dst_ip="163.29.151.253" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34138,1.28995,999,0 0 0 0 0 0 0 0 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.29.32.97" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
