<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="suspicious" value="0.816691,1.01575,504,1 0 0 0 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="123.197.60.94" dst_port="5120"/>
            <filter dst_ip="162.191.28.129" dst_port="443"/>
            <filter dst_ip="77.70.53.202" dst_port="53430"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="163.175.216.15" dst_port="22"/>
        </slice>
        <from usec="0" sec="1522818739"/>
        <to usec="0" sec="1522818745"/>
    </anomaly>
    <anomaly type="suspicious" value="0.847132,1.04849,999,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.226.11.171" dst_ip="210.20.230.103" src_port="48686" dst_port="995"/>
        </slice>
        <from usec="0" sec="1522818740"/>
        <to usec="0" sec="1522818743"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954398,0.986215,503,1 1 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="163.226.124.66" dst_port="443"/>
            <filter src_ip="163.226.124.66" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.847132,1.04849,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.226.0.86" dst_ip="110.249.75.132" src_port="8888"/>
        </slice>
        <from usec="0" sec="1522818285"/>
        <to usec="0" sec="1522818291"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="191.80.216.110"/>
        </slice>
        <from usec="0" sec="1522818545"/>
        <to usec="0" sec="1522818850"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.253.52.236" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1522818863"/>
        <to usec="0" sec="1522818901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,002,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="203.178.115.252" src_port="54041" dst_port="137"/>
        </slice>
        <from usec="0" sec="1522818580"/>
        <to usec="0" sec="1522818584"/>
    </anomaly>
    <anomaly type="suspicious" value="0.776418,1.05074,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="202.52.153.147" dst_ip="202.52.153.147" dst_port="123" proto="udp"/>
        </slice>
        <from usec="0" sec="1522818267"/>
        <to usec="0" sec="1522818744"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="27.35.30.13" src_port="7822" dst_port="5958"/>
        </slice>
        <from usec="0" sec="1522818896"/>
        <to usec="0" sec="1522818897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="42.51.109.209" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1522818208"/>
        <to usec="0" sec="1522818209"/>
    </anomaly>
    <anomaly type="suspicious" value="0.776418,1.05074,020,0 1 0 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.92.189.147"/>
        </slice>
        <from usec="0" sec="1522818421"/>
        <to usec="0" sec="1522818422"/>
    </anomaly>
    <anomaly type="suspicious" value="0.847132,1.04849,010,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="5.66.244.247" src_port="45432"/>
        </slice>
        <from usec="0" sec="1522818896"/>
        <to usec="0" sec="1522818900"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="123.175.84.99" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1522818439"/>
        <to usec="0" sec="1522818440"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="172.102.63.135"/>
        </slice>
        <from usec="0" sec="1522818346"/>
        <to usec="0" sec="1522818348"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="116.133.119.44" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1522818247"/>
        <to usec="0" sec="1522818249"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="45.138.243.196"/>
        </slice>
        <from usec="0" sec="1522818015"/>
        <to usec="0" sec="1522818191"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="46.12.118.54"/>
        </slice>
        <from usec="0" sec="1522818753"/>
        <to usec="0" sec="1522818754"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="50.138.30.68"/>
        </slice>
        <from usec="0" sec="1522818304"/>
        <to usec="0" sec="1522818863"/>
    </anomaly>
    <anomaly type="suspicious" value="0.847132,1.04849,011,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="123.197.60.50" dst_port="1807"/>
        </slice>
        <from usec="0" sec="1522818286"/>
        <to usec="0" sec="1522818291"/>
    </anomaly>
    <anomaly type="suspicious" value="0.847132,1.04849,011,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="123.197.60.94" src_port="8000" dst_port="5120"/>
        </slice>
        <from usec="0" sec="1522818288"/>
        <to usec="0" sec="1522818291"/>
    </anomaly>
    <anomaly type="suspicious" value="0.847132,1.04849,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="113.7.186.189" src_port="1433"/>
            <filter dst_ip="113.7.186.189" src_port="1444"/>
            <filter dst_ip="113.7.186.189" src_port="2433"/>
        </slice>
        <from usec="0" sec="1522818573"/>
        <to usec="0" sec="1522818605"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07351,1.19079,999,0 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="203.178.109.152" dst_ip="37.189.26.186" src_port="32938" dst_port="5938"/>
        </slice>
        <from usec="0" sec="1522818895"/>
        <to usec="0" sec="1522818897"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87614,1.12563,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="202.52.153.147" dst_ip="202.52.153.147" dst_port="123" proto="udp"/>
        </slice>
        <from usec="0" sec="1522818272"/>
        <to usec="0" sec="1522818744"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.88.198.45"/>
        </slice>
        <from usec="0" sec="1522818749"/>
        <to usec="0" sec="1522818751"/>
    </anomaly>
    <anomaly type="suspicious" value="1.11147,1.13961,502,1 1 1 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="133.27.178.162" dst_ip="58.197.193.105" src_port="22"/>
            <filter src_ip="133.27.126.18" dst_ip="58.197.193.105" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="104.20.71.51"/>
        </slice>
        <from usec="0" sec="1522818384"/>
        <to usec="0" sec="1522818747"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="47.103.31.159"/>
        </slice>
        <from usec="0" sec="1522818309"/>
        <to usec="0" sec="1522818744"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="159.36.221.152"/>
        </slice>
        <from usec="0" sec="1522818456"/>
        <to usec="0" sec="1522818457"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="125.34.244.127" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1522818034"/>
        <to usec="0" sec="1522818039"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="207.229.77.213"/>
        </slice>
        <from usec="0" sec="1522818261"/>
        <to usec="0" sec="1522818522"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12572,1.1888,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="155.66.62.158"/>
        </slice>
        <from usec="0" sec="1522818226"/>
        <to usec="0" sec="1522818392"/>
    </anomaly>
    <anomaly type="suspicious" value="0.939377,1.12353,020,1 0 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.92.189.147"/>
        </slice>
        <from usec="0" sec="1522818421"/>
        <to usec="0" sec="1522818422"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924333,1.08264,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1522818000"/>
        <to usec="0" sec="1522818828"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924333,1.08264,502,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="202.52.159.174"/>
        </slice>
        <from usec="0" sec="1522818001"/>
        <to usec="0" sec="1522818108"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924333,1.08264,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.178.102.42"/>
        </slice>
        <from usec="0" sec="1522818001"/>
        <to usec="0" sec="1522818108"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924333,1.08264,503,0 0 0 1 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="133.27.24.199"/>
        </slice>
        <from usec="0" sec="1522818002"/>
        <to usec="0" sec="1522818108"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924333,1.08264,504,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="118.108.231.241"/>
        </slice>
        <from usec="0" sec="1522818031"/>
        <to usec="0" sec="1522818099"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924333,1.08264,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1522818000"/>
        <to usec="0" sec="1522818828"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924333,1.08264,504,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="202.4.237.79"/>
        </slice>
        <from usec="0" sec="1522818615"/>
        <to usec="0" sec="1522818622"/>
    </anomaly>
    <anomaly type="suspicious" value="0.924333,1.08264,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.226.124.136"/>
        </slice>
        <from usec="0" sec="1522818012"/>
        <to usec="0" sec="1522818702"/>
    </anomaly>
    <anomaly type="suspicious" value="1.1898,1.22872,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1522818000"/>
        <to usec="0" sec="1522818828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.1898,1.22872,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1522818000"/>
        <to usec="0" sec="1522818828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25228,1.28088,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1522818000"/>
        <to usec="0" sec="1522818198"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25228,1.28088,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1522818000"/>
        <to usec="0" sec="1522818198"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.102.39"/>
        </slice>
        <from usec="0" sec="1522818000"/>
        <to usec="0" sec="1522818046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="51.227.214.153"/>
        </slice>
        <from usec="0" sec="1522818090"/>
        <to usec="0" sec="1522818136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,999,0 0 0 0 0 0 1 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="45.175.56.127" dst_ip="203.178.102.39" dst_port="53"/>
        </slice>
        <from usec="0" sec="1522818090"/>
        <to usec="0" sec="1522818136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,011,0 0 0 0 0 0 1 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="123.197.60.50" dst_port="1807"/>
        </slice>
        <from usec="0" sec="1522818225"/>
        <to usec="0" sec="1522818271"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.104.99" dst_port="53"/>
        </slice>
        <from usec="0" sec="1522818225"/>
        <to usec="0" sec="1522818271"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.104.113" dst_port="53"/>
        </slice>
        <from usec="0" sec="1522818225"/>
        <to usec="0" sec="1522818271"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="74.128.232.239" src_port="53"/>
        </slice>
        <from usec="0" sec="1522818225"/>
        <to usec="0" sec="1522818271"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,011,0 0 0 0 0 0 1 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="123.197.60.94" dst_port="5120"/>
        </slice>
        <from usec="0" sec="1522818225"/>
        <to usec="0" sec="1522818271"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.226.220.30" src_port="53"/>
        </slice>
        <from usec="0" sec="1522818225"/>
        <to usec="0" sec="1522818271"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,020,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.178.115.252" dst_port="53"/>
            <filter dst_ip="203.178.115.252"/>
        </slice>
        <from usec="0" sec="1522818225"/>
        <to usec="0" sec="1522818271"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="203.178.105.37"/>
        </slice>
        <from usec="0" sec="1522818225"/>
        <to usec="0" sec="1522818271"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,999,0 0 0 0 0 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="205.198.252.57" dst_ip="203.178.102.39" dst_port="53"/>
        </slice>
        <from usec="0" sec="1522818225"/>
        <to usec="0" sec="1522818271"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,504,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.178.102.16" src_port="443"/>
        </slice>
        <from usec="0" sec="1522818225"/>
        <to usec="0" sec="1522818271"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.226.237.5"/>
        </slice>
        <from usec="0" sec="1522818225"/>
        <to usec="0" sec="1522818271"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,999,0 0 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="61.135.128.174" dst_ip="202.254.3.99" dst_port="53"/>
        </slice>
        <from usec="0" sec="1522818225"/>
        <to usec="0" sec="1522818361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,011,0 0 0 0 0 0 1 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="123.197.60.50" dst_port="1807"/>
        </slice>
        <from usec="0" sec="1522818405"/>
        <to usec="0" sec="1522818451"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,011,0 0 0 0 0 0 1 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="123.197.60.94" dst_port="5120"/>
        </slice>
        <from usec="0" sec="1522818405"/>
        <to usec="0" sec="1522818451"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09021,1.12046,011,0 0 0 1 0 0 1 0 0 1 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="94.170.128.251" src_port="8554"/>
            <filter dst_ip="123.197.60.50" dst_port="1807"/>
            <filter dst_ip="5.66.244.247" dst_port="45432"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="104.95.123.152" dst_port="138"/>
        </slice>
        <from usec="0" sec="1522818585"/>
        <to usec="0" sec="1522818631"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,999,0 0 0 0 0 0 1 0 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="192.216.127.9" dst_ip="203.178.98.89" src_port="53"/>
        </slice>
        <from usec="0" sec="1522818090"/>
        <to usec="0" sec="1522818721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="202.52.152.135"/>
        </slice>
        <from usec="0" sec="1522818675"/>
        <to usec="0" sec="1522818721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="202.52.152.94"/>
        </slice>
        <from usec="0" sec="1522818675"/>
        <to usec="0" sec="1522818721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="212.67.240.93"/>
        </slice>
        <from usec="0" sec="1522818810"/>
        <to usec="0" sec="1522818856"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.27.18.144" src_port="16971"/>
        </slice>
        <from usec="0" sec="1522818810"/>
        <to usec="0" sec="1522818856"/>
    </anomaly>
    <anomaly type="suspicious" value="0.764236,1.07284,010,0 0 0 0 0 0 1 0 0 0 0 0,dntscSYN">
        <slice>
            <filter src_port="445" dst_port="445"/>
        </slice>
        <from usec="0" sec="1522818810"/>
        <to usec="0" sec="1522818856"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828102,0.992372,504,1 1 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="182.245.106.14" dst_ip="163.226.182.201" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.906924,1.02838,504,0 0 0 1 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="13.250.239.209" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743086,1.01807,999,0 0 0 0 0 0 1 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="146.182.133.198" dst_ip="202.254.3.106" dst_port="53"/>
            <filter src_ip="146.182.133.198" dst_ip="202.254.3.99" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.944514,1.00973,504,1 0 0 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="163.226.7.58" dst_port="443"/>
            <filter src_ip="203.178.110.229" dst_ip="162.191.28.102" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.906924,1.02838,504,0 0 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="202.56.145.98" dst_port="443"/>
            <filter src_ip="202.56.145.98" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.11147,1.13961,502,1 1 1 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="77.70.53.228" dst_port="54206"/>
            <filter dst_ip="163.175.216.15" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.743086,1.01807,503,0 0 0 0 0 0 1 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="5.66.47.173" dst_ip="202.52.153.154" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.906924,1.02838,503,0 0 0 1 0 0 0 0 0 1 0 0,point_to_point">
        <slice>
            <filter src_ip="91.188.192.204" dst_ip="163.226.104.49" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.944514,1.00973,504,1 0 0 0 0 0 1 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.56.180.50" dst_port="53"/>
            <filter src_ip="202.56.180.50" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.11147,1.13961,010,1 1 1 0 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="94.170.128.251" dst_port="8554"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958808,0.969046,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="104.247.191.207" dst_ip="163.226.131.3" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.226.101.250" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958808,0.969046,999,0 0 0 0 0 0 0 0 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.99.236" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.881646,1.01207,999,0 0 0 0 0 0 1 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.104.116" src_port="53"/>
            <filter dst_ip="203.178.104.116" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.725305,0.906471,504,1 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="163.226.24.84" dst_ip="52.230.35.192" dst_port="443"/>
            <filter src_ip="163.226.100.144" dst_ip="52.230.35.192" dst_port="443"/>
            <filter src_ip="133.27.249.148" dst_ip="52.230.35.192" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="104.7.121.253" dst_ip="203.178.111.21" src_port="49934" dst_port="8333"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="115.127.230.186" dst_ip="23.160.234.116" src_port="443" dst_port="49590"/>
            <filter src_ip="115.127.230.186" dst_ip="23.160.234.116" src_port="443" dst_port="49583"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="13.250.142.72" dst_port="8554"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="133.27.75.154" dst_ip="115.223.214.169"/>
            <filter src_ip="133.27.75.154" dst_port="80"/>
            <filter src_ip="133.27.75.154" dst_port="443"/>
            <filter dst_ip="115.223.214.169" dst_port="80"/>
            <filter dst_ip="115.223.214.169" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958808,0.969046,999,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="138.118.15.159" dst_ip="203.178.111.21" src_port="58376" dst_port="8333"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="138.118.30.80" dst_ip="133.234.148.148" src_port="42816" dst_port="8333"/>
            <filter src_ip="138.118.30.80" dst_ip="163.226.86.11" src_port="60460" dst_port="8333"/>
            <filter src_ip="138.118.30.80" dst_ip="203.178.111.21" src_port="36306" dst_port="8333"/>
            <filter src_ip="138.118.30.80" dst_ip="203.178.111.23" src_port="53118" dst_port="8333"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="158.186.28.87" dst_ip="163.226.124.109" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="173.178.197.51" dst_ip="163.226.128.151" src_port="443" dst_port="35670"/>
            <filter src_ip="173.178.197.51" dst_ip="163.226.0.111" src_port="443" dst_port="58601"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="180.130.189.11" dst_ip="163.226.96.87" src_port="80"/>
            <filter src_ip="180.130.189.11" dst_ip="163.226.96.87" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="192.15.253.133" dst_port="129"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="198.27.12.157" dst_ip="163.226.163.26" src_port="80"/>
            <filter src_ip="198.27.12.157" dst_ip="163.226.163.26" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,502,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="202.56.165.102" dst_ip="185.39.76.20" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="211.187.223.38" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="23.164.43.194" dst_ip="163.226.101.13" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.178.107.77" src_port="443"/>
            <filter dst_ip="203.178.107.77" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="23.36.59.39" dst_ip="163.226.81.26" src_port="80" dst_port="47130"/>
            <filter src_ip="23.36.59.39" dst_ip="163.226.149.14" src_port="80" dst_port="57527"/>
            <filter src_ip="23.36.59.39" dst_ip="202.52.157.30" src_port="80" dst_port="57904"/>
            <filter src_ip="23.36.59.39" dst_ip="163.226.20.96" src_port="80" dst_port="51972"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958808,0.969046,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="202.52.153.154" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="124.215.85.184" src_port="57174" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="139.79.220.118" dst_ip="163.226.130.75" src_port="443" dst_port="57255"/>
            <filter src_ip="139.79.220.118" dst_ip="163.226.130.75" src_port="443" dst_port="57254"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958808,0.969046,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="74.128.171.166" dst_ip="202.52.159.13" src_port="443" dst_port="33366"/>
            <filter src_ip="74.128.171.166" dst_ip="202.52.159.13" src_port="443" dst_port="33365"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958808,0.969046,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="74.128.87.151" dst_ip="163.226.126.74" src_port="443" dst_port="53531"/>
            <filter src_ip="74.128.87.151" dst_ip="163.226.126.74" src_port="443" dst_port="35755"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="84.127.216.237" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="91.237.167.239" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958808,0.969046,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="163.226.9.56" dst_ip="101.93.208.56" dst_port="80"/>
            <filter src_ip="163.226.217.32" dst_ip="101.93.208.56" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="203.178.99.218" dst_ip="105.88.132.150" src_port="443"/>
            <filter src_ip="203.178.99.218" dst_ip="105.88.132.150" dst_port="137"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="163.226.124.109" dst_ip="158.186.28.87" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.226.130.173" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.881646,1.01207,504,0 0 0 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="172.184.246.65" src_port="443"/>
            <filter dst_ip="163.226.21.135" src_port="443"/>
            <filter dst_ip="163.226.21.135" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="192.22.18.30" dst_ip="163.226.44.170" src_port="80"/>
            <filter src_ip="117.13.237.38" dst_ip="163.226.44.170" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,504,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="117.13.232.214" dst_ip="198.221.142.175" dst_port="80"/>
            <filter src_ip="163.226.21.87" dst_ip="198.221.142.175" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.916994,1.03007,504,1 0 0 0 0 0 0 0 0 0 0 1,mptp">
        <slice>
            <filter dst_ip="202.52.159.165" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,020,0 0 0 0 0 0 0 0 0 1 1 0,DDoSIC">
        <slice>
            <filter dst_ip="202.56.157.226"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,999,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.178.103.30"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,503,0 0 0 0 0 0 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="163.226.235.214" dst_ip="38.101.228.39" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.641296,0.909071,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="133.27.61.32" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958808,0.969046,503,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="163.226.244.203" dst_ip="157.204.160.245" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958808,0.969046,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="172.184.247.92" dst_ip="163.226.100.183" src_port="80" dst_port="64362"/>
            <filter src_ip="172.184.247.92" dst_ip="163.226.131.81" src_port="80" dst_port="61807"/>
            <filter src_ip="172.184.247.92" dst_ip="163.226.0.191" src_port="80" dst_port="56053"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958808,0.969046,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.226.101.210" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958808,0.969046,010,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="61.119.74.56" src_port="38493" dst_port="23"/>
            <filter src_ip="61.119.74.56" src_port="56556" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.3492,1.74934,010,1 1 1 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="198.199.219.98" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.26546,1.22335,999,1 1 1 0 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="203.178.104.81" dst_port="123"/>
            <filter dst_ip="203.178.105.200" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.40304,1.18287,504,1 1 1 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="202.52.159.13" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.18328,1.06405,504,1 0 0 0 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.56.180.50" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.43363,1.14203,503,1 1 0 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.178.99.208" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55607,1.2256,503,1 1 0 1 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.178.105.80" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.278,1.2693,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="51.227.214.153" src_port="5689" dst_port="5080"/>
        </slice>
        <from usec="0" sec="1522818000"/>
        <to usec="0" sec="1522818130"/>
    </anomaly>
    <anomaly type="anomalous" value="1.40304,1.18287,999,1 1 1 0 0 0 0 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="185.80.239.34" src_port="41740" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.3492,1.74934,999,1 1 1 1 1 1 1 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="185.80.239.146" src_port="54685" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.22916,1.65718,504,1 1 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.56.180.50" src_port="443"/>
            <filter dst_ip="202.56.180.50" src_port="53"/>
            <filter dst_ip="202.52.159.13" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55607,1.2256,011,1 1 0 1 0 0 1 0 0 1 1 1,ntscTCPRSTrp">
        <slice>
            <filter dst_ip="198.199.219.98" dst_port="80"/>
            <filter dst_ip="51.227.214.153"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.02571,1.5499,999,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="45.199.96.210" dst_ip="203.178.100.193"/>
            <filter src_ip="45.199.96.210" dst_port="3010"/>
            <filter dst_ip="203.178.100.193" dst_port="3010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.8445,1.55443,504,0 0 0 1 1 1 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="52.42.200.114" dst_ip="163.226.131.97" src_port="443"/>
            <filter src_ip="52.42.200.114" dst_ip="202.56.180.50" src_port="443"/>
        </slice>
        <from usec="0" sec="1522818025"/>
        <to usec="0" sec="1522818800"/>
    </anomaly>
    <anomaly type="anomalous" value="1.83584,1.51714,504,0 0 0 1 1 1 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.226.188.145" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.05385,1.54838,504,1 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.178.110.229" src_port="443"/>
            <filter dst_ip="203.178.110.229" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.02571,1.5499,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.178.104.116" src_port="53"/>
            <filter src_ip="203.178.99.208" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.8445,1.55443,010,0 0 0 1 1 1 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="185.211.49.104" dst_port="513"/>
        </slice>
        <from usec="0" sec="1522818208"/>
        <to usec="0" sec="1522818638"/>
    </anomaly>
    <anomaly type="anomalous" value="1.99034,1.57715,999,0 0 0 1 1 1 1 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.52.159.223" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.52793,1.26374,010,1 1 1 0 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.178.109.117" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.11413,1.61247,020,0 0 0 1 1 1 1 0 0 1 1 1,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="5.131.27.207"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.52793,1.26374,010,1 1 1 0 0 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="113.7.186.189" dst_port="1433"/>
            <filter src_ip="113.7.186.189" dst_port="1444"/>
            <filter src_ip="113.7.186.189" dst_port="2433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.40304,1.18287,999,1 1 1 0 0 0 0 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="5.131.27.207" src_port="5113" dst_port="5060"/>
            <filter src_ip="5.131.27.207" src_port="5099" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.19119,1.04176,999,1 1 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="94.24.39.64" dst_ip="202.52.153.147" dst_port="123"/>
            <filter src_ip="94.24.39.64" dst_ip="203.178.105.200" dst_port="123"/>
            <filter src_ip="94.24.39.64" dst_ip="203.178.104.81" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.6593,1.30945,503,0 0 0 1 1 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.226.140.255" src_port="443"/>
            <filter dst_ip="163.226.140.255" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.69355,1.30765,503,1 0 0 1 1 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.178.105.80" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.40304,1.18287,999,1 1 1 0 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.178.105.182" dst_ip="206.92.27.14"/>
            <filter src_ip="203.178.105.182" dst_ip="204.61.218.31"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.14111,1.611,504,1 0 0 1 1 1 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.52.159.232" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.3492,1.74934,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="111.153.18.228" dst_port="3306"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.38626,1.16443,504,0 0 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="182.87.54.198" src_port="443"/>
            <filter dst_ip="163.226.131.29" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.13373,1.06626,504,0 0 0 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="183.67.244.244" src_port="443"/>
            <filter dst_ip="163.226.188.199" src_port="443"/>
            <filter dst_ip="203.178.115.252" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.13373,1.06626,504,0 0 0 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.226.130.127"/>
            <filter dst_ip="163.226.211.153" src_port="443"/>
            <filter dst_ip="163.226.211.153" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.01692,0.966608,999,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="119.193.7.142" dst_ip="202.52.153.147"/>
            <filter src_ip="119.193.7.142" dst_port="123"/>
            <filter dst_ip="202.52.153.147" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.02571,1.5499,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="71.229.100.129"/>
            <filter src_ip="74.128.232.135" dst_ip="163.226.125.93" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.01692,0.966608,504,1 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="173.178.197.14" dst_ip="163.226.130.46" src_port="443"/>
            <filter src_ip="173.178.197.14" dst_ip="163.226.20.49" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.01692,0.966608,999,1 0 0 0 0 0 0 0 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.52.159.228" src_port="53"/>
            <filter dst_ip="202.52.159.228" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
