<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="anomalous" value="2.30325,1.78138,999,1 1 1 1 1 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.76.202.247" dst_ip="206.35.27.47"/>
            <filter src_ip="203.76.202.247" dst_ip="204.186.33.26"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.70093,1.5112,503,1 1 1 1 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.221.81.235" dst_ip="67.93.25.56" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="191.124.70.83"/>
        </slice>
        <from usec="0" sec="1530939761"/>
        <to usec="0" sec="1530940356"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.236.65.181"/>
        </slice>
        <from usec="0" sec="1530939784"/>
        <to usec="0" sec="1530940197"/>
    </anomaly>
    <anomaly type="anomalous" value="2.17281,1.68485,999,1 1 1 0 0 0 1 0 0 1 1 1,ptpposcaUDP">
        <slice>
            <filter src_ip="192.4.172.199" dst_ip="203.76.197.93" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="139.80.202.130"/>
        </slice>
        <from usec="0" sec="1530939840"/>
        <to usec="0" sec="1530940217"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="62.211.197.114" src_port="5106" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1530939988"/>
        <to usec="0" sec="1530939989"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="47.88.152.69"/>
        </slice>
        <from usec="0" sec="1530940197"/>
        <to usec="0" sec="1530940417"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="203.76.212.20"/>
        </slice>
        <from usec="0" sec="1530939947"/>
        <to usec="0" sec="1530939948"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="74.122.142.6" dst_port="23"/>
        </slice>
        <from usec="0" sec="1530940209"/>
        <to usec="0" sec="1530940220"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="172.235.175.217"/>
        </slice>
        <from usec="0" sec="1530939769"/>
        <to usec="0" sec="1530940398"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="103.206.111.106" dst_port="445"/>
        </slice>
        <from usec="0" sec="1530940083"/>
        <to usec="0" sec="1530940087"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="50.235.221.88"/>
        </slice>
        <from usec="0" sec="1530939837"/>
        <to usec="0" sec="1530940480"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,004,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="183.90.56.165" dst_port="445"/>
        </slice>
        <from usec="0" sec="1530940036"/>
        <to usec="0" sec="1530940140"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="103.202.190.190" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1530939678"/>
        <to usec="0" sec="1530939689"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="123.108.10.60" dst_port="445"/>
        </slice>
        <from usec="0" sec="1530939952"/>
        <to usec="0" sec="1530939953"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="125.45.83.49" dst_port="445"/>
        </slice>
        <from usec="0" sec="1530940252"/>
        <to usec="0" sec="1530940256"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="107.113.172.61"/>
        </slice>
        <from usec="0" sec="1530939711"/>
        <to usec="0" sec="1530939713"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="207.19.77.54"/>
        </slice>
        <from usec="0" sec="1530939861"/>
        <to usec="0" sec="1530939862"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="45.19.155.146"/>
        </slice>
        <from usec="0" sec="1530939821"/>
        <to usec="0" sec="1530939824"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="104.127.31.24"/>
        </slice>
        <from usec="0" sec="1530940413"/>
        <to usec="0" sec="1530940414"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="139.80.164.208"/>
        </slice>
        <from usec="0" sec="1530939826"/>
        <to usec="0" sec="1530939827"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.220.23.44"/>
        </slice>
        <from usec="0" sec="1530939744"/>
        <to usec="0" sec="1530940038"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65139,1.51862,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="31.207.150.244"/>
        </slice>
        <from usec="0" sec="1530939886"/>
        <to usec="0" sec="1530939888"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47511,1.27608,503,1 0 0 1 1 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.76.196.47" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.39055,1.97415,503,0 0 0 1 1 1 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="203.76.193.21" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.02588,1.87572,010,0 0 0 1 1 1 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="139.80.74.0" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1530939600"/>
        <to usec="0" sec="1530939888"/>
    </anomaly>
    <anomaly type="anomalous" value="1.77113,1.74073,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1530939600"/>
        <to usec="0" sec="1530940158"/>
    </anomaly>
    <anomaly type="anomalous" value="3.23109,3.01658,010,1 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.221.110.210" dst_port="23"/>
        </slice>
        <from usec="0" sec="1530939600"/>
        <to usec="0" sec="1530939646"/>
    </anomaly>
    <anomaly type="anomalous" value="1.81015,1.56119,010,1 1 1 1 0 0 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="60.33.179.140" src_port="49305"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35886,1.28589,999,1 1 0 0 0 0 1 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="151.226.10.97" src_port="6246" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1530940135"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="anomalous" value="2.93937,2.29144,010,1 1 1 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="47.96.80.231" dst_port="52869"/>
            <filter src_ip="187.145.5.243" src_port="30269" dst_port="22"/>
            <filter src_ip="23.8.20.196" src_port="56275" dst_port="5080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.37164,3.08198,010,1 1 0 0 0 0 1 1 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="73.2.209.134" dst_port="5061"/>
        </slice>
        <from usec="0" sec="1530940382"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="anomalous" value="3.17654,3.01745,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.76.212.20" dst_port="53"/>
        </slice>
        <from usec="0" sec="1530939600"/>
        <to usec="0" sec="1530939646"/>
    </anomaly>
    <anomaly type="anomalous" value="1.86984,1.45664,504,1 0 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.221.83.202" src_port="443"/>
            <filter dst_ip="163.221.83.202" src_port="80"/>
            <filter dst_ip="163.221.83.85" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.6443,2.07144,999,1 1 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.76.193.9"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.71585,2.10818,504,1 1 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="202.1.192.92" dst_port="443"/>
            <filter src_ip="202.1.192.92" dst_port="53"/>
            <filter src_ip="202.11.192.237" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.39055,1.97415,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.221.83.241" src_port="443"/>
            <filter dst_ip="163.221.83.28" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.39055,1.97415,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.221.135.128" src_port="443"/>
            <filter dst_ip="163.221.82.88" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.85052,1.42511,999,1 1 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.76.205.253" dst_ip="115.164.145.240"/>
            <filter src_ip="203.76.205.253" src_port="53"/>
            <filter src_ip="203.76.194.57" dst_ip="115.164.145.240"/>
            <filter src_ip="203.76.194.57" src_port="53"/>
            <filter dst_ip="115.164.145.240" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.0827,1.63864,010,1 1 1 0 0 0 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="31.164.189.242" src_port="62586" dst_port="80"/>
            <filter src_ip="31.164.189.242" src_port="62586" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.48658,1.33686,999,0 0 0 1 1 0 1 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.221.134.143" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.32792,1.2181,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="210.132.92.136" src_port="443"/>
            <filter src_ip="163.221.83.34" dst_ip="210.132.92.136" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34013,1.21872,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="154.251.125.94" dst_ip="163.221.82.142" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34013,1.21872,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="13.29.251.204" src_port="80"/>
            <filter dst_ip="13.29.251.204" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.45358,1.21596,999,1 0 0 1 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="35.152.212.190" dst_ip="202.11.192.1" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.93692,1.5803,999,1 1 1 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="115.164.145.240" dst_ip="203.76.194.57"/>
            <filter src_ip="115.164.145.240" dst_ip="203.76.205.253"/>
            <filter src_ip="115.164.145.240" dst_port="53"/>
            <filter src_ip="221.144.49.1" dst_ip="203.76.194.57"/>
            <filter src_ip="221.144.49.1" dst_ip="203.76.205.253"/>
            <filter src_ip="221.144.49.1" dst_port="53"/>
            <filter dst_ip="203.76.194.57" dst_port="53"/>
            <filter dst_ip="203.76.205.253" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.09937,1.06781,504,1 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="163.221.82.229" dst_ip="23.26.77.232" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34013,1.21872,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="163.221.75.101" dst_ip="0.0.0.0" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.76431,1.40294,999,1 0 0 1 1 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.76.193.9"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34013,1.21872,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.221.83.59" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.09937,1.06781,504,1 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.221.83.243" src_port="443"/>
            <filter dst_ip="163.221.83.243" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.27589,3.02367,010,0 0 0 1 0 0 1 1 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="60.33.179.140" src_port="49305"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.86984,1.45664,011,1 0 0 1 1 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="187.145.5.243" src_port="22" dst_port="30269"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.4763,1.28018,010,0 0 0 0 0 0 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="194.100.114.226"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34013,1.21872,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="74.122.134.87" dst_ip="163.221.81.190" src_port="443" dst_port="52420"/>
            <filter src_ip="74.122.134.87" dst_ip="163.221.81.190" src_port="443" dst_port="52419"/>
            <filter src_ip="74.122.134.87" dst_ip="163.221.81.190" src_port="443" dst_port="51392"/>
            <filter src_ip="74.122.134.87" dst_ip="163.221.82.65" src_port="443" dst_port="64369"/>
            <filter src_ip="74.122.134.87" dst_ip="163.221.82.65" src_port="443" dst_port="61286"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34013,1.21872,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="74.122.118.72" dst_ip="163.221.20.52" src_port="443" dst_port="51530"/>
            <filter src_ip="74.122.118.72" dst_ip="163.221.20.52" src_port="443" dst_port="51527"/>
            <filter src_ip="74.122.118.72" dst_ip="163.221.20.52" src_port="443" dst_port="51525"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34013,1.21872,999,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="203.232.32.1" dst_ip="149.43.223.243" src_port="26077" dst_port="873"/>
            <filter src_ip="203.232.32.2" dst_ip="149.43.223.243" src_port="64696" dst_port="873"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.84411,1.53144,999,1 1 1 0 0 0 0 0 0 1 1 0,ntscUDPOther">
        <slice>
            <filter src_ip="23.25.65.86" dst_port="69"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.32792,1.2181,504,0 0 0 1 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="203.76.242.62" dst_ip="163.221.134.126" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.53924,2.01137,010,1 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="185.166.13.192" src_port="52768"/>
            <filter src_ip="46.238.213.197" dst_port="81"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.45358,1.21596,504,1 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.221.81.189" src_port="443"/>
            <filter dst_ip="163.221.81.189" dst_port="26881"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.32792,1.2181,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.221.82.222" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.6443,2.07144,010,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="92.63.62.145" src_port="43023"/>
            <filter src_ip="192.200.165.54" dst_port="1900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.32792,1.2181,504,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="31.10.81.240" src_port="443"/>
            <filter dst_ip="163.221.81.183" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.45358,1.21596,504,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter src_ip="172.234.214.0" dst_port="808"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.53924,2.01137,504,1 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.11.192.237" src_port="443"/>
            <filter dst_ip="202.1.192.116" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.46946,2.01267,010,0 0 0 1 1 1 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="5.64.19.213" src_port="48825"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.32792,1.2181,504,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.221.81.247" src_port="443"/>
            <filter dst_ip="163.221.8.74" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.53924,2.01137,010,1 0 0 1 1 1 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="181.40.87.151" src_port="42133"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.57999,1.27754,504,1 0 0 1 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.11.192.15" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.59028,1.27813,504,1 0 0 0 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.11.192.67" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.86984,1.45664,999,1 0 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.1.192.92" src_port="53"/>
            <filter src_ip="185.211.34.93" src_port="52422" dst_port="7235"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.32792,1.2181,503,0 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.76.196.47" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34013,1.21872,010,0 0 0 0 0 0 0 0 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="203.76.202.81" dst_ip="46.63.81.94" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.26179,1.13744,504,1 0 0 0 0 0 1 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.221.82.198" dst_port="443"/>
            <filter src_ip="163.221.82.198" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34013,1.21872,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="202.1.192.4" dst_ip="60.181.70.115" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="203.76.212.21" dst_ip="185.120.143.32" src_port="3122" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530940216"/>
        <to usec="0" sec="1530940405"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,503,1 0 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="104.161.75.237" dst_ip="163.221.3.95" src_port="80" dst_port="60371" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530939711"/>
        <to usec="0" sec="1530939713"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.230.197.30" dst_ip="52.161.87.180" src_port="80" dst_port="18698" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530939792"/>
        <to usec="0" sec="1530939793"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="173.205.230.244" dst_ip="163.221.82.26" src_port="443" dst_port="62819" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530939666"/>
        <to usec="0" sec="1530939668"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.221.8.74" dst_ip="34.22.135.165" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530940333"/>
        <to usec="0" sec="1530940335"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.221.83.202" dst_ip="185.181.134.15" src_port="49826" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530939711"/>
        <to usec="0" sec="1530939713"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.221.82.49" dst_ip="205.98.160.181" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530940333"/>
        <to usec="0" sec="1530940405"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,999,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="64.14.98.109" dst_ip="163.221.26.32" src_port="993" dst_port="53448" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530940327"/>
        <to usec="0" sec="1530940329"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.221.82.93" dst_ip="146.84.187.211" src_port="50150" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530940147"/>
        <to usec="0" sec="1530940284"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="74.122.142.134" dst_ip="163.221.82.207" src_port="443" dst_port="53207" proto="udp"/>
        </slice>
        <from usec="0" sec="1530939769"/>
        <to usec="0" sec="1530939949"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.221.83.91" dst_ip="37.76.114.196" src_port="54574" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530940334"/>
        <to usec="0" sec="1530940405"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="198.216.109.72" dst_ip="163.221.81.241" src_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530940237"/>
        <to usec="0" sec="1530940469"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="203.76.202.81" dst_ip="198.107.177.121" src_port="49236" dst_port="873" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530939784"/>
        <to usec="0" sec="1530940497"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.221.66.68" dst_ip="54.92.105.97" src_port="64412" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530940195"/>
        <to usec="0" sec="1530940335"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="23.179.229.19" dst_ip="163.221.82.137" src_port="80" dst_port="59813" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530939951"/>
        <to usec="0" sec="1530939953"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.230.114.226" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530939744"/>
        <to usec="0" sec="1530940335"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,010,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="178.124.163.9"/>
        </slice>
        <from usec="0" sec="1530939671"/>
        <to usec="0" sec="1530939888"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,503,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.76.202.81"/>
        </slice>
        <from usec="0" sec="1530940403"/>
        <to usec="0" sec="1530940404"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.230.115.150" dst_ip="59.199.147.238" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530940209"/>
        <to usec="0" sec="1530940356"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,999,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="163.147.0.86" src_port="9512" dst_port="5060" proto="udp"/>
        </slice>
        <from usec="0" sec="1530940128"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="62.127.161.90"/>
        </slice>
        <from usec="0" sec="1530939918"/>
        <to usec="0" sec="1530939920"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="107.125.26.137" dst_port="7777" proto="tcp"/>
        </slice>
        <from usec="0" sec="1530940251"/>
        <to usec="0" sec="1530940329"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="37.131.236.90"/>
        </slice>
        <from usec="0" sec="1530940311"/>
        <to usec="0" sec="1530940314"/>
    </anomaly>
    <anomaly type="suspicious" value="0.731397,1.04935,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="131.14.120.200"/>
        </slice>
        <from usec="0" sec="1530939918"/>
        <to usec="0" sec="1530939920"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20954,1.22473,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="182.100.13.64" dst_port="445"/>
        </slice>
        <from usec="0" sec="1530940319"/>
        <to usec="0" sec="1530940329"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20954,1.22473,012,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="107.125.15.119" dst_port="7777"/>
        </slice>
        <from usec="0" sec="1530940251"/>
        <to usec="0" sec="1530940252"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20954,1.22473,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="111.82.253.152"/>
        </slice>
        <from usec="0" sec="1530940202"/>
        <to usec="0" sec="1530940203"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20954,1.22473,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="107.125.15.119" src_port="7777"/>
        </slice>
        <from usec="0" sec="1530940251"/>
        <to usec="0" sec="1530940252"/>
    </anomaly>
    <anomaly type="suspicious" value="1.1625,1.25442,503,0 0 0 1 1 0 0 0 0 1 0 0,malphfl">
        <slice>
            <filter src_ip="133.230.117.50" dst_ip="114.205.132.150" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.708763,1.04863,999,1 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="46.153.36.252" dst_port="8545"/>
        </slice>
        <from usec="0" sec="1530939602"/>
        <to usec="0" sec="1530940459"/>
    </anomaly>
    <anomaly type="suspicious" value="0.708763,1.04863,503,1 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="202.0.235.105" dst_ip="202.11.194.254" src_port="80"/>
        </slice>
        <from usec="0" sec="1530940202"/>
        <to usec="0" sec="1530940264"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08874,1.26335,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1530939600"/>
        <to usec="0" sec="1530940428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07366,1.26275,020,0 0 0 1 1 0 0 0 0 0 0 0,sptpDoSIC">
        <slice>
            <filter src_ip="115.77.213.246" dst_ip="203.76.205.116"/>
            <filter src_ip="115.77.213.246" dst_ip="202.1.254.20"/>
        </slice>
        <from usec="0" sec="1530939603"/>
        <to usec="0" sec="1530939798"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08874,1.26335,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1530939600"/>
        <to usec="0" sec="1530940428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07366,1.26275,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.230.115.150" dst_ip="204.142.114.70" dst_port="443"/>
        </slice>
        <from usec="0" sec="1530939619"/>
        <to usec="0" sec="1530940145"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07366,1.26275,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="31.178.103.183" dst_port="23"/>
        </slice>
        <from usec="0" sec="1530939608"/>
        <to usec="0" sec="1530940248"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07366,1.26275,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="203.76.212.20" src_port="1024" dst_port="23"/>
            <filter src_ip="203.76.212.20" src_port="1028" dst_port="23"/>
            <filter src_ip="203.76.212.20" src_port="1033" dst_port="23"/>
        </slice>
        <from usec="0" sec="1530939606"/>
        <to usec="0" sec="1530940336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07366,1.26275,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="62.216.177.39" dst_port="445"/>
        </slice>
        <from usec="0" sec="1530939600"/>
        <to usec="0" sec="1530940428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07366,1.26275,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="1.115.17.252" src_port="19891" dst_port="23"/>
            <filter src_ip="1.115.17.252" src_port="19635" dst_port="23"/>
            <filter src_ip="1.115.17.252" src_port="20147" dst_port="23"/>
        </slice>
        <from usec="0" sec="1530939600"/>
        <to usec="0" sec="1530940427"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07366,1.26275,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="202.1.192.141" dst_ip="126.245.44.47" src_port="443"/>
        </slice>
        <from usec="0" sec="1530939601"/>
        <to usec="0" sec="1530940427"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07366,1.26275,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="88.0.10.27" dst_ip="163.221.135.217" src_port="58194" dst_port="8333"/>
        </slice>
        <from usec="0" sec="1530939601"/>
        <to usec="0" sec="1530940426"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07366,1.26275,010,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="109.249.108.8" src_port="24791"/>
        </slice>
        <from usec="0" sec="1530939602"/>
        <to usec="0" sec="1530940426"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07366,1.26275,503,0 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="133.230.197.107" src_port="80"/>
        </slice>
        <from usec="0" sec="1530939602"/>
        <to usec="0" sec="1530940425"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07366,1.26275,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="182.20.184.16" src_port="37579" dst_port="23"/>
            <filter src_ip="182.20.184.16" src_port="38347" dst_port="23"/>
            <filter src_ip="182.20.184.16" src_port="38091" dst_port="23"/>
        </slice>
        <from usec="0" sec="1530939604"/>
        <to usec="0" sec="1530940406"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07366,1.26275,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="172.34.253.61" src_port="443"/>
        </slice>
        <from usec="0" sec="1530939608"/>
        <to usec="0" sec="1530940428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07366,1.26275,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="5.180.235.13" src_port="13710" dst_port="23"/>
            <filter src_ip="5.180.235.13" src_port="13198" dst_port="23"/>
            <filter src_ip="5.180.235.13" src_port="12942" dst_port="23"/>
        </slice>
        <from usec="0" sec="1530939614"/>
        <to usec="0" sec="1530940422"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07366,1.26275,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="60.100.15.123" dst_ip="133.251.45.31" src_port="1863" dst_port="18183"/>
        </slice>
        <from usec="0" sec="1530939660"/>
        <to usec="0" sec="1530940397"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07366,1.26275,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="49.24.193.25" dst_ip="202.11.198.127" src_port="52505" dst_port="993"/>
            <filter src_ip="49.24.193.25" dst_ip="202.11.198.127" src_port="52492" dst_port="993"/>
            <filter src_ip="49.24.193.25" dst_ip="202.11.198.127" src_port="41732" dst_port="993"/>
        </slice>
        <from usec="0" sec="1530940336"/>
        <to usec="0" sec="1530940341"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="64.247.191.254"/>
        </slice>
        <from usec="0" sec="1530939600"/>
        <to usec="0" sec="1530939646"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.1.221.236"/>
        </slice>
        <from usec="0" sec="1530939960"/>
        <to usec="0" sec="1530940006"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.1.221.235"/>
        </slice>
        <from usec="0" sec="1530939960"/>
        <to usec="0" sec="1530940006"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.76.203.188" dst_port="53"/>
        </slice>
        <from usec="0" sec="1530939960"/>
        <to usec="0" sec="1530940006"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958355,1.12013,010,1 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.118.108.81" dst_port="23"/>
        </slice>
        <from usec="0" sec="1530939960"/>
        <to usec="0" sec="1530940006"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="192.63.237.71"/>
        </slice>
        <from usec="0" sec="1530939960"/>
        <to usec="0" sec="1530940006"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="192.97.56.177"/>
        </slice>
        <from usec="0" sec="1530939960"/>
        <to usec="0" sec="1530940006"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958355,1.12013,010,1 0 0 0 0 0 1 0 0 0 0 0,poscaSYN">
        <slice>
            <filter src_ip="14.148.242.29" dst_ip="163.221.83.101" src_port="40020"/>
        </slice>
        <from usec="0" sec="1530940005"/>
        <to usec="0" sec="1530940051"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.116.183.13" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1530939960"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="92.63.62.155" src_port="80"/>
        </slice>
        <from usec="0" sec="1530940050"/>
        <to usec="0" sec="1530940096"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="113.131.86.14"/>
        </slice>
        <from usec="0" sec="1530940140"/>
        <to usec="0" sec="1530940186"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="107.125.24.68" dst_port="7777"/>
        </slice>
        <from usec="0" sec="1530940140"/>
        <to usec="0" sec="1530940186"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="62.127.161.90" dst_port="443"/>
        </slice>
        <from usec="0" sec="1530940140"/>
        <to usec="0" sec="1530940186"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="92.63.62.147" dst_port="7367"/>
        </slice>
        <from usec="0" sec="1530940140"/>
        <to usec="0" sec="1530940186"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="92.63.62.147" dst_port="7368"/>
        </slice>
        <from usec="0" sec="1530940140"/>
        <to usec="0" sec="1530940186"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="92.63.62.164" dst_port="7321"/>
        </slice>
        <from usec="0" sec="1530940140"/>
        <to usec="0" sec="1530940186"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="92.63.62.164" dst_port="7322"/>
        </slice>
        <from usec="0" sec="1530940140"/>
        <to usec="0" sec="1530940186"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="92.63.62.164" dst_port="7323"/>
        </slice>
        <from usec="0" sec="1530940140"/>
        <to usec="0" sec="1530940186"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="185.248.38.40" src_port="59817" dst_port="8088"/>
        </slice>
        <from usec="0" sec="1530940140"/>
        <to usec="0" sec="1530940186"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="107.125.26.137" dst_port="7777"/>
        </slice>
        <from usec="0" sec="1530940140"/>
        <to usec="0" sec="1530940231"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="208.228.40.219" src_port="55163" dst_port="10050"/>
        </slice>
        <from usec="0" sec="1530940140"/>
        <to usec="0" sec="1530940231"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,dntscSYN">
        <slice>
            <filter src_port="6666" dst_port="443"/>
        </slice>
        <from usec="0" sec="1530940185"/>
        <to usec="0" sec="1530940231"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="210.162.188.95" dst_ip="203.76.212.20" dst_port="53"/>
            <filter src_ip="210.162.188.94" dst_ip="203.76.212.20" dst_port="53"/>
        </slice>
        <from usec="0" sec="1530940275"/>
        <to usec="0" sec="1530940321"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.76.207.111"/>
        </slice>
        <from usec="0" sec="1530940275"/>
        <to usec="0" sec="1530940321"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958355,1.12013,020,1 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="151.226.10.97"/>
        </slice>
        <from usec="0" sec="1530940112"/>
        <to usec="0" sec="1530940321"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="203.76.202.59"/>
        </slice>
        <from usec="0" sec="1530939735"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="107.125.26.137" dst_port="7777"/>
        </slice>
        <from usec="0" sec="1530940410"/>
        <to usec="0" sec="1530940456"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,502,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="115.24.229.134"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="60.33.179.140" dst_port="49305"/>
            <filter dst_ip="60.33.179.140"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="210.162.188.95" dst_ip="203.76.212.20" dst_port="53"/>
            <filter src_ip="210.162.188.94" dst_ip="203.76.212.20" dst_port="53"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.1.239.144"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.76.203.188" dst_port="53"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.116.205.213"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.251.17.250" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.221.134.143"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05693,1.11073,504,1 0 0 0 0 0 1 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="172.240.150.94" dst_ip="203.76.196.36" dst_port="443"/>
            <filter src_ip="63.31.231.9" dst_ip="203.76.196.36" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.116.182.165" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1530940275"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.116.182.186"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.221.244.139"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,011,0 0 0 0 0 0 1 0 0 0 0 0,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="92.63.62.149"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958355,1.12013,999,1 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="133.230.196.89" dst_ip="80.43.247.188" src_port="587"/>
            <filter src_ip="133.230.196.93" dst_ip="80.43.247.188" src_port="587"/>
        </slice>
        <from usec="0" sec="1530939600"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.116.204.162"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.221.82.165"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="75.80.177.199"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.251.18.61" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="203.76.193.12"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,502,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="103.129.252.220"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="1.26.152.88"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.221.226.17"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754273,1.12246,053,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.76.202.81" dst_port="80"/>
        </slice>
        <from usec="0" sec="1530940455"/>
        <to usec="0" sec="1530940501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876123,1.11309,010,0 0 0 0 0 0 1 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="103.223.132.119" src_port="6666"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876123,1.11309,010,0 0 0 0 0 0 1 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="196.84.20.119" src_port="6666"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.909122,1.06955,999,0 0 0 1 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="203.76.203.160" src_port="53"/>
            <filter src_ip="203.76.203.160" dst_ip="178.146.39.196" src_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876123,1.11309,503,0 0 0 0 0 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="172.34.31.207" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.11472,1.13974,010,0 0 0 0 0 0 1 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="219.138.226.235" dst_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.856508,1.03931,504,1 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="202.1.192.4" dst_ip="126.173.176.211" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.1,1.13908,010,0 0 0 1 0 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="150.116.183.29" dst_port="54748"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.837263,1.03858,999,1 0 0 1 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="149.43.252.56" dst_ip="203.232.32.1" dst_port="161"/>
            <filter src_ip="199.134.1.128" dst_ip="203.232.32.1" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.856508,1.03931,999,1 0 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="203.76.203.142" dst_port="123"/>
            <filter dst_ip="203.76.202.177" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876123,1.11309,010,0 0 0 0 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="194.100.114.226"/>
            <filter src_ip="5.64.19.212" src_port="48886"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.221.241.41"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="101.119.107.62" dst_ip="163.221.133.51" src_port="443" dst_port="32801"/>
            <filter src_ip="101.119.107.62" dst_ip="163.221.82.134" src_port="443" dst_port="50250"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="104.173.40.73" dst_ip="163.221.199.44" src_port="443" dst_port="51635"/>
            <filter src_ip="104.173.40.73" dst_ip="163.221.199.44" src_port="443" dst_port="51627"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="133.230.196.90" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="136.15.201.72" dst_ip="163.221.135.217" src_port="18439" dst_port="8333"/>
            <filter src_ip="136.15.201.72" dst_ip="163.221.135.217" src_port="14993" dst_port="8333"/>
            <filter src_ip="136.15.201.72" dst_ip="203.76.206.242" src_port="34547" dst_port="8333"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.221.83.34" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,010,0 0 0 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="196.84.20.96" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="198.107.177.121" dst_ip="203.76.202.81" src_port="873" dst_port="49236"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="206.210.252.195" src_port="24691" dst_port="23"/>
            <filter src_ip="206.210.252.195" src_port="23444" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="0.0.0.0" dst_ip="163.221.75.101" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="203.76.196.36" dst_ip="107.123.77.150" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="163.221.135.217" dst_ip="119.19.190.55" src_port="8333" dst_port="45460"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,502,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="203.232.32.1" dst_ip="149.43.223.183" src_port="22"/>
            <filter src_ip="203.232.32.2" dst_ip="149.43.223.183" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="54.102.198.68" dst_ip="163.221.241.16" dst_port="443"/>
            <filter src_ip="54.102.198.68" dst_ip="163.221.241.16" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.221.67.70" src_port="443"/>
            <filter dst_ip="163.221.67.70" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.221.66.19" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,504,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="163.221.83.156" src_port="443"/>
            <filter src_ip="205.98.160.181" dst_ip="163.221.82.49" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="198.235.184.46" src_port="29011"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="203.76.196.36" dst_ip="172.240.150.94" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.909122,1.06955,010,0 0 0 1 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="164.212.47.71" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,999,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="185.92.77.247" dst_ip="163.221.192.121" dst_port="3389"/>
            <filter src_ip="185.156.178.109" dst_ip="163.221.192.121" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.926876,1.07025,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="203.76.196.36" dst_ip="206.254.253.112" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
