<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="anomalous" value="5.91569,5.00044,010,1 1 1 0 0 0 1 1 1 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="118.209.50.153" dst_port="80"/>
        </slice>
        <from usec="0" sec="1528261200"/>
        <to usec="0" sec="1528261578"/>
    </anomaly>
    <anomaly type="anomalous" value="2.83512,2.26756,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="163.111.159.87" dst_port="80"/>
            <filter src_ip="163.111.159.87" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.78419,2.21592,504,1 1 1 1 1 1 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="202.56.210.27"/>
            <filter src_ip="202.50.191.12" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.90084,4.9955,010,1 1 0 0 0 0 1 1 1 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="192.56.42.20" dst_port="27017"/>
        </slice>
        <from usec="0" sec="1528261470"/>
        <to usec="0" sec="1528261665"/>
    </anomaly>
    <anomaly type="anomalous" value="2.95686,2.27618,504,1 1 1 1 1 1 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.50.191.12" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.88735,2.26738,503,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="172.150.94.180" src_port="80"/>
            <filter dst_ip="163.111.18.172" src_port="443"/>
            <filter dst_ip="163.111.134.188" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.86445,1.76113,010,1 1 1 1 0 0 1 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="107.74.39.247" dst_port="27017"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.86521,2.32181,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="162.156.150.11" src_port="443"/>
            <filter dst_ip="163.111.134.54" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.92703,2.26531,010,1 1 0 1 1 1 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="185.237.20.26" src_port="59264"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.83512,2.26756,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="17.240.244.193" src_port="443"/>
            <filter src_ip="17.240.244.193" src_port="80"/>
            <filter src_ip="17.240.244.195" src_port="443"/>
            <filter src_ip="17.240.244.195" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.90588,2.27636,504,1 0 0 1 1 1 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.56.210.60" src_port="443"/>
            <filter src_ip="208.67.237.33" dst_ip="202.56.210.60" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.83512,2.26756,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.189.119.80" src_port="80"/>
            <filter src_ip="203.189.124.80" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.93525,2.3304,010,0 0 0 1 1 1 1 0 0 1 1 1,ntscSYN139445">
        <slice>
            <filter src_ip="61.248.143.100" src_port="41469" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.66625,1.66113,504,1 1 1 0 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.189.113.25" src_port="443"/>
            <filter dst_ip="203.189.113.25" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.93594,2.28718,504,1 0 1 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="216.213.199.182" dst_ip="163.111.130.30"/>
            <filter src_ip="216.213.199.182" src_port="443"/>
            <filter src_ip="80.99.87.97" dst_port="52869"/>
            <filter dst_ip="163.111.130.30" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.54437,2.03866,504,1 1 1 1 1 0 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="31.15.21.247" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.88735,2.26738,010,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="185.181.202.61" src_port="56991"/>
            <filter src_ip="181.89.47.89" src_port="50752"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.34147,1.97115,504,1 1 1 1 1 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="202.56.210.27" src_port="53"/>
            <filter dst_ip="202.56.210.27" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.92703,2.26531,504,1 1 0 1 1 1 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.50.191.151" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04585,1.55281,999,1 1 1 0 0 0 1 0 0 1 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.94.110.238" src_port="7234" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.42352,1.80429,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1528261200"/>
        <to usec="0" sec="1528262028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.42352,1.80429,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1528261200"/>
        <to usec="0" sec="1528262028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.42352,1.80429,020,0 0 0 1 0 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="144.230.47.183"/>
        </slice>
        <from usec="0" sec="1528261200"/>
        <to usec="0" sec="1528261937"/>
    </anomaly>
    <anomaly type="suspicious" value="1.42352,1.80429,010,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="24.154.65.174"/>
        </slice>
        <from usec="0" sec="1528261210"/>
        <to usec="0" sec="1528261668"/>
    </anomaly>
    <anomaly type="suspicious" value="1.53023,1.85103,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1528261200"/>
        <to usec="0" sec="1528262028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.53023,1.85103,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1528261200"/>
        <to usec="0" sec="1528262028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.61385,1.91504,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1528261200"/>
        <to usec="0" sec="1528262028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.61385,1.91504,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1528261200"/>
        <to usec="0" sec="1528261938"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04585,1.55281,502,1 1 1 0 0 0 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="220.130.152.18" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.11867,1.64269,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.111.116.26" src_port="80"/>
            <filter src_ip="163.111.116.26" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.26866,1.5618,999,1 1 0 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="198.11.176.152" dst_port="80"/>
            <filter dst_ip="133.252.77.169" dst_port="50348"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.11867,1.64269,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.111.159.89" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.43918,1.64929,999,1 0 0 0 0 0 0 0 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.50.191.155" src_port="53"/>
            <filter dst_ip="202.50.191.155" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17423,1.56482,999,1 1 1 0 0 0 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="203.189.119.191" dst_ip="206.28.249.31"/>
            <filter src_ip="203.189.119.191" dst_ip="204.194.32.1"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.49758,1.72312,999,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="150.182.116.1" dst_ip="203.189.122.211" src_port="22344" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04585,1.55281,504,1 1 1 0 0 0 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="202.50.191.51" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.49758,1.72312,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.50.188.184" src_port="443"/>
            <filter dst_ip="163.111.134.92" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.49758,1.72312,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.111.94.230" src_port="443"/>
            <filter dst_ip="163.111.94.230" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.48141,1.63401,503,1 1 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.189.119.80" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.43918,1.64929,504,1 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="74.125.10.171" dst_ip="163.111.157.128" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.43918,1.64929,503,1 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="203.189.122.211" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.11867,1.64269,504,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="131.34.142.226" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.49758,1.72312,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.111.19.96" src_port="443"/>
            <filter dst_ip="163.111.19.96" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.49758,1.72312,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.111.19.47" src_port="443"/>
            <filter src_ip="2.12.199.112" dst_ip="163.111.19.47" dst_port="30303"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.43918,1.64929,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.111.135.83" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.49758,1.72312,504,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="31.15.21.241" dst_ip="163.111.18.43" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.49758,1.72312,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.111.18.21" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.574,1.66137,010,1 0 0 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="61.248.143.100" src_port="41469" dst_port="445"/>
            <filter src_ip="216.213.199.231" dst_ip="163.111.130.30" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.49758,1.72312,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.111.18.2" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.49758,1.72312,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="163.111.17.193" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.11867,1.64269,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.111.134.187" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.49758,1.72312,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.111.134.252" src_port="80"/>
            <filter src_ip="31.15.21.215" dst_ip="163.111.134.252" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.574,1.66137,504,1 0 0 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.111.19.232" src_port="443"/>
            <filter dst_ip="133.117.69.207" src_port="443"/>
            <filter dst_ip="202.56.241.124" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.43918,1.64929,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.111.17.98" src_port="443"/>
            <filter dst_ip="202.56.207.106" src_port="443"/>
            <filter dst_ip="202.56.207.106" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.49758,1.72312,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.189.113.201" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.11867,1.64269,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="202.50.188.61" dst_ip="40.77.173.225" src_port="80" dst_port="50295"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
