<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="suspicious" value="0.883169,1.13939,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.213.100.172" dst_ip="126.184.231.152" src_port="35136" dst_port="1701"/>
        </slice>
        <from usec="0" sec="1533704684"/>
        <to usec="0" sec="1533704693"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="23.160.66.172" dst_port="445"/>
        </slice>
        <from usec="0" sec="1533705007"/>
        <to usec="0" sec="1533705011"/>
    </anomaly>
    <anomaly type="suspicious" value="0.970025,1.06404,503,1 1 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="202.62.191.114" dst_ip="8.25.224.193" dst_port="80"/>
            <filter src_ip="202.62.191.114" dst_ip="23.177.157.7" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.883169,1.13939,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.106.140.38" dst_port="443"/>
        </slice>
        <from usec="0" sec="1533704568"/>
        <to usec="0" sec="1533704794"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="113.94.117.2" dst_port="445"/>
        </slice>
        <from usec="0" sec="1533704725"/>
        <to usec="0" sec="1533704729"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="47.104.230.39"/>
        </slice>
        <from usec="0" sec="1533704699"/>
        <to usec="0" sec="1533704700"/>
    </anomaly>
    <anomaly type="suspicious" value="1.10481,1.20667,999,1 1 0 0 0 0 1 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="134.152.61.94" src_port="5514" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1533704773"/>
        <to usec="0" sec="1533705301"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="172.244.39.58"/>
        </slice>
        <from usec="0" sec="1533704440"/>
        <to usec="0" sec="1533704441"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="111.162.3.138"/>
        </slice>
        <from usec="0" sec="1533705198"/>
        <to usec="0" sec="1533705200"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="5.180.61.98" dst_port="22"/>
        </slice>
        <from usec="0" sec="1533704684"/>
        <to usec="0" sec="1533704695"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.212.66.88"/>
        </slice>
        <from usec="0" sec="1533704533"/>
        <to usec="0" sec="1533704650"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="193.231.74.200"/>
        </slice>
        <from usec="0" sec="1533704546"/>
        <to usec="0" sec="1533705210"/>
    </anomaly>
    <anomaly type="suspicious" value="0.883169,1.13939,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="212.125.161.192" src_port="8067" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1533704798"/>
        <to usec="0" sec="1533704899"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="107.161.160.211"/>
        </slice>
        <from usec="0" sec="1533704629"/>
        <to usec="0" sec="1533705099"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="24.12.226.246"/>
        </slice>
        <from usec="0" sec="1533704754"/>
        <to usec="0" sec="1533704756"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="46.106.150.129"/>
        </slice>
        <from usec="0" sec="1533704511"/>
        <to usec="0" sec="1533704512"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="202.203.189.1" dst_port="445"/>
        </slice>
        <from usec="0" sec="1533704739"/>
        <to usec="0" sec="1533704743"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="118.186.182.47" dst_port="445"/>
        </slice>
        <from usec="0" sec="1533704490"/>
        <to usec="0" sec="1533704495"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="202.96.239.39" dst_port="445"/>
        </slice>
        <from usec="0" sec="1533704618"/>
        <to usec="0" sec="1533704622"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="202.118.165.174" dst_port="445"/>
        </slice>
        <from usec="0" sec="1533704949"/>
        <to usec="0" sec="1533704954"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="43.32.78.26" dst_port="445"/>
        </slice>
        <from usec="0" sec="1533704615"/>
        <to usec="0" sec="1533704626"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="183.225.233.231" dst_port="445"/>
        </slice>
        <from usec="0" sec="1533704759"/>
        <to usec="0" sec="1533704760"/>
    </anomaly>
    <anomaly type="suspicious" value="0.883169,1.13939,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="192.193.40.2" dst_port="194"/>
        </slice>
        <from usec="0" sec="1533704465"/>
        <to usec="0" sec="1533704526"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="139.160.133.106"/>
        </slice>
        <from usec="0" sec="1533704548"/>
        <to usec="0" sec="1533704848"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="50.59.238.79"/>
        </slice>
        <from usec="0" sec="1533704507"/>
        <to usec="0" sec="1533704695"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.227.217.253"/>
        </slice>
        <from usec="0" sec="1533704762"/>
        <to usec="0" sec="1533705293"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="31.252.110.6"/>
        </slice>
        <from usec="0" sec="1533704772"/>
        <to usec="0" sec="1533705214"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21633,1.30363,502,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="61.170.180.98" src_port="22"/>
        </slice>
        <from usec="0" sec="1533704702"/>
        <to usec="0" sec="1533704730"/>
    </anomaly>
    <anomaly type="suspicious" value="0.883169,1.13939,010,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.213.234.231" dst_port="23"/>
        </slice>
        <from usec="0" sec="1533705028"/>
        <to usec="0" sec="1533705030"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533705228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533705228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="163.213.21.83"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533704598"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="163.213.179.100"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533704596"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.213.251.209"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533704596"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,504,0 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="111.210.29.97"/>
        </slice>
        <from usec="0" sec="1533704401"/>
        <to usec="0" sec="1533704591"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,010,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="222.187.231.158" src_port="39210"/>
        </slice>
        <from usec="0" sec="1533704401"/>
        <to usec="0" sec="1533704687"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,010,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="177.248.130.85"/>
        </slice>
        <from usec="0" sec="1533704402"/>
        <to usec="0" sec="1533704682"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,020,0 0 0 1 0 0 0 0 0 0 0 0,sptpDoSIC">
        <slice>
            <filter src_ip="150.228.49.29"/>
        </slice>
        <from usec="0" sec="1533704536"/>
        <to usec="0" sec="1533704636"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,999,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="104.126.63.136" dst_ip="163.213.100.35" src_port="17260"/>
        </slice>
        <from usec="0" sec="1533704403"/>
        <to usec="0" sec="1533704868"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,010,0 0 0 1 0 0 0 0 0 0 0 0,sptpDoSSYN">
        <slice>
            <filter src_ip="95.142.241.41" dst_ip="203.161.117.2" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533704956"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,504,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter dst_ip="172.224.235.166"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533705138"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="37.83.208.228"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533705138"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,504,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="54.4.133.1"/>
        </slice>
        <from usec="0" sec="1533704414"/>
        <to usec="0" sec="1533705129"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,504,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="118.166.195.190"/>
        </slice>
        <from usec="0" sec="1533704745"/>
        <to usec="0" sec="1533705124"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,504,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="52.62.12.92"/>
        </slice>
        <from usec="0" sec="1533704958"/>
        <to usec="0" sec="1533705120"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,504,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="52.1.180.197" dst_ip="203.161.120.90" src_port="443"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533705228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,010,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="116.19.214.112" src_port="58857"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533705224"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="94.183.185.121"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533705227"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,503,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="182.162.61.12"/>
        </slice>
        <from usec="0" sec="1533704401"/>
        <to usec="0" sec="1533705221"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="212.43.39.53"/>
        </slice>
        <from usec="0" sec="1533704402"/>
        <to usec="0" sec="1533705225"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,504,0 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.213.101.49" dst_port="443"/>
        </slice>
        <from usec="0" sec="1533704406"/>
        <to usec="0" sec="1533705228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.161.113.30" dst_port="53"/>
        </slice>
        <from usec="0" sec="1533704435"/>
        <to usec="0" sec="1533705228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.814201,1.14598,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="125.129.184.23"/>
        </slice>
        <from usec="0" sec="1533705156"/>
        <to usec="0" sec="1533705222"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28048,1.36136,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533705228"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28048,1.36136,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533705138"/>
    </anomaly>
    <anomaly type="suspicious" value="1.42177,1.47506,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533705138"/>
    </anomaly>
    <anomaly type="suspicious" value="1.42177,1.47506,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533705138"/>
    </anomaly>
    <anomaly type="suspicious" value="0.81158,1.15619,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="64.248.63.102"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533704446"/>
    </anomaly>
    <anomaly type="suspicious" value="0.81158,1.15619,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.123.126.179" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533704446"/>
    </anomaly>
    <anomaly type="suspicious" value="0.81158,1.15619,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.123.126.251" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533704446"/>
    </anomaly>
    <anomaly type="suspicious" value="0.81158,1.15619,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.123.125.229" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533704446"/>
    </anomaly>
    <anomaly type="suspicious" value="0.81158,1.15619,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.180.199.205" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1533704400"/>
        <to usec="0" sec="1533704446"/>
    </anomaly>
    <anomaly type="suspicious" value="0.81158,1.15619,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="162.207.135.52"/>
        </slice>
        <from usec="0" sec="1533704445"/>
        <to usec="0" sec="1533704491"/>
    </anomaly>
    <anomaly type="suspicious" value="0.81158,1.15619,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.161.127.44" dst_port="53"/>
        </slice>
        <from usec="0" sec="1533704535"/>
        <to usec="0" sec="1533704581"/>
    </anomaly>
    <anomaly type="suspicious" value="0.81158,1.15619,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="146.185.38.24" src_port="46573" dst_port="6755"/>
            <filter src_ip="146.185.38.24" src_port="46573" dst_port="6754"/>
            <filter src_ip="146.185.38.24" src_port="46573" dst_port="6756"/>
        </slice>
        <from usec="0" sec="1533704625"/>
        <to usec="0" sec="1533704671"/>
    </anomaly>
    <anomaly type="suspicious" value="0.81158,1.15619,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="5.15.232.123"/>
        </slice>
        <from usec="0" sec="1533704625"/>
        <to usec="0" sec="1533704671"/>
    </anomaly>
    <anomaly type="suspicious" value="0.81158,1.15619,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="146.185.38.0" src_port="48069" dst_port="18561"/>
        </slice>
        <from usec="0" sec="1533704625"/>
        <to usec="0" sec="1533704671"/>
    </anomaly>
    <anomaly type="suspicious" value="0.81158,1.15619,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="107.175.3.205" dst_port="194"/>
        </slice>
        <from usec="0" sec="1533704805"/>
        <to usec="0" sec="1533704851"/>
    </anomaly>
    <anomaly type="suspicious" value="0.81158,1.15619,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.106.123.250"/>
        </slice>
        <from usec="0" sec="1533704940"/>
        <to usec="0" sec="1533704986"/>
    </anomaly>
    <anomaly type="suspicious" value="0.81158,1.15619,011,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="192.207.7.37"/>
        </slice>
        <from usec="0" sec="1533705075"/>
        <to usec="0" sec="1533705121"/>
    </anomaly>
    <anomaly type="suspicious" value="0.81158,1.15619,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.180.198.243"/>
        </slice>
        <from usec="0" sec="1533705075"/>
        <to usec="0" sec="1533705121"/>
    </anomaly>
    <anomaly type="suspicious" value="0.81158,1.15619,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.180.199.205" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1533705075"/>
        <to usec="0" sec="1533705121"/>
    </anomaly>
    <anomaly type="suspicious" value="0.81158,1.15619,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="80.29.188.11" dst_port="52869"/>
        </slice>
        <from usec="0" sec="1533705120"/>
        <to usec="0" sec="1533705166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22824,1.31673,504,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="34.63.205.0" dst_ip="163.213.250.219" src_port="443"/>
            <filter src_ip="34.48.201.21" dst_ip="163.213.250.219" src_port="443"/>
        </slice>
        <from usec="0" sec="1533705075"/>
        <to usec="0" sec="1533705121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22824,1.31673,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.123.126.251" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1533705075"/>
        <to usec="0" sec="1533705121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22824,1.31673,010,0 0 0 0 0 0 1 1 0 0 0 0,poscaSYN">
        <slice>
            <filter src_ip="212.148.1.87" dst_ip="163.213.249.8" src_port="44879"/>
        </slice>
        <from usec="0" sec="1533705075"/>
        <to usec="0" sec="1533705121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22824,1.31673,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.213.128.92" src_port="53"/>
        </slice>
        <from usec="0" sec="1533705075"/>
        <to usec="0" sec="1533705121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22824,1.31673,011,0 0 0 0 0 0 1 1 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="203.161.124.27" dst_ip="192.207.7.36" dst_port="45035"/>
        </slice>
        <from usec="0" sec="1533705075"/>
        <to usec="0" sec="1533705121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22824,1.31673,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.123.125.229" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1533705075"/>
        <to usec="0" sec="1533705121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22824,1.31673,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.161.113.216" dst_port="53"/>
        </slice>
        <from usec="0" sec="1533705075"/>
        <to usec="0" sec="1533705121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21438,1.26318,502,1 1 1 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="109.51.201.9" src_port="22"/>
            <filter dst_ip="5.181.153.109" src_port="5900" dst_port="33929"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.970025,1.06404,999,1 1 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="133.123.126.172"/>
            <filter src_ip="133.123.126.184"/>
            <filter src_ip="133.123.126.171"/>
            <filter src_ip="133.123.126.190"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00244,1.06604,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.213.100.25" src_port="443"/>
            <filter src_ip="8.136.72.8" dst_ip="163.213.100.25" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688035,0.988504,504,1 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="203.161.113.214" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00244,1.06604,504,1 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="163.213.100.25" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811283,1.09974,020,0 0 0 1 0 0 0 0 0 1 0 0,sptpDoSIC">
        <slice>
            <filter src_ip="203.161.115.56" dst_ip="185.99.77.119"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954204,1.08268,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="163.213.124.71" dst_port="443"/>
            <filter src_ip="163.213.124.71" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.811283,1.09974,999,0 0 0 1 0 0 0 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.161.121.113" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954204,1.08268,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="202.62.145.255" dst_ip="74.234.19.218"/>
            <filter src_ip="202.62.145.255" src_port="80"/>
            <filter dst_ip="74.234.19.218" src_port="443"/>
            <filter dst_ip="74.234.19.218" src_port="80"/>
            <filter src_ip="202.62.145.255" dst_ip="5.14.124.133" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00244,1.06604,504,1 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="163.213.162.176" dst_port="443"/>
            <filter src_ip="163.213.162.176" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954204,1.08268,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.213.21.83" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954204,1.08268,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.213.102.38" src_port="80"/>
            <filter dst_ip="163.213.102.38" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954204,1.08268,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="149.100.76.183" dst_port="443"/>
            <filter src_ip="149.100.76.183" dst_port="8000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954204,1.08268,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="173.193.145.166" dst_ip="163.213.23.64" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954204,1.08268,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.213.14.246" src_port="80"/>
            <filter dst_ip="163.213.14.246" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688035,0.988504,999,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="185.99.77.0"/>
            <filter src_ip="46.184.148.251" dst_port="8545"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954204,1.08268,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="192.218.235.177" dst_ip="163.213.18.161" src_port="443" dst_port="60007"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954204,1.08268,504,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="104.163.94.55" dst_ip="163.213.124.71" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.970025,1.06404,999,1 1 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="203.161.115.48"/>
            <filter dst_ip="134.152.61.94"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.688035,0.988504,999,1 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="203.161.122.53" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954204,1.08268,010,0 0 0 0 0 0 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="17.234.69.234" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954204,1.08268,010,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="151.60.113.25" src_port="29011"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954204,1.08268,012,0 0 0 0 0 0 0 0 0 1 1 1,poscaFIN">
        <slice>
            <filter src_ip="104.163.95.123" dst_ip="163.213.82.18" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00244,1.06604,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter src_ip="117.96.242.253" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00244,1.06604,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.213.101.217" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954204,1.08268,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.213.79.6" src_port="443"/>
            <filter dst_ip="163.213.20.228" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954204,1.08268,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.213.79.10" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954204,1.08268,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.213.80.227" src_port="443"/>
            <filter dst_ip="163.213.16.140" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00244,1.06604,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.213.102.111" src_port="443"/>
            <filter dst_ip="163.213.102.111" src_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00244,1.06604,504,1 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="31.117.47.159" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00244,1.06604,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.161.49.16" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.954204,1.08268,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.161.116.100" src_port="53"/>
            <filter dst_ip="203.161.116.100" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958262,1.05427,020,1 0 0 1 0 0 0 0 0 1 1 0,ttl_error">
        <slice>
            <filter src_ip="133.106.125.105"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00244,1.06604,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="202.62.145.188" dst_port="53"/>
            <filter src_ip="203.161.121.46" dst_port="53"/>
            <filter src_ip="203.161.121.46" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.00957,1.58159,999,1 1 1 1 1 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.161.126.249" dst_ip="206.211.4.1"/>
            <filter src_ip="203.161.126.249" dst_ip="204.189.209.238"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.38395,1.32418,010,1 1 1 0 0 0 1 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="182.139.37.35" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47374,1.30104,010,1 1 1 0 0 0 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="144.131.177.58" src_port="44278" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.38566,1.36282,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="61.170.180.98" src_port="34979" dst_port="22"/>
        </slice>
        <from usec="0" sec="1533704445"/>
        <to usec="0" sec="1533704695"/>
    </anomaly>
    <anomaly type="anomalous" value="1.83801,1.59796,010,1 1 0 0 0 0 1 1 1 1 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="46.64.216.65" dst_ip="163.213.249.60" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.28079,1.23831,999,1 1 1 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="81.161.173.99" dst_ip="150.180.163.82" dst_port="6544"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.18517,1.74694,999,1 1 1 0 0 0 1 1 1 1 1 1,alphfl">
        <slice>
            <filter src_ip="81.161.172.130" dst_ip="163.213.120.60" dst_port="6592"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.75398,1.52847,999,1 0 0 0 0 0 1 1 1 1 1 0,ptpposcaUDP">
        <slice>
            <filter src_ip="192.68.144.196" dst_ip="203.161.117.42" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.67961,1.59312,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.161.107.240" src_port="53"/>
            <filter dst_ip="203.161.107.240" dst_port="53"/>
        </slice>
        <from usec="0" sec="1533705075"/>
        <to usec="0" sec="1533705121"/>
    </anomaly>
    <anomaly type="anomalous" value="1.67961,1.59312,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.161.127.44" dst_port="53"/>
        </slice>
        <from usec="0" sec="1533705075"/>
        <to usec="0" sec="1533705121"/>
    </anomaly>
    <anomaly type="anomalous" value="1.67961,1.59312,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.123.126.179" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1533705075"/>
        <to usec="0" sec="1533705121"/>
    </anomaly>
    <anomaly type="anomalous" value="1.67961,1.59312,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.180.198.229" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1533705075"/>
        <to usec="0" sec="1533705121"/>
    </anomaly>
    <anomaly type="anomalous" value="1.67961,1.59312,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.123.125.181" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1533705075"/>
        <to usec="0" sec="1533705121"/>
    </anomaly>
    <anomaly type="anomalous" value="1.80589,1.60266,999,0 0 0 1 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="163.213.128.126" dst_port="53"/>
            <filter src_ip="163.213.129.93" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.67961,1.59312,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.161.114.56" dst_port="53"/>
        </slice>
        <from usec="0" sec="1533705075"/>
        <to usec="0" sec="1533705121"/>
    </anomaly>
    <anomaly type="anomalous" value="1.72686,1.54012,010,0 0 0 0 0 0 1 1 1 1 1 0,mptp">
        <slice>
            <filter dst_ip="150.180.199.211" dst_port="54748"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.67961,1.59312,011,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="203.161.124.27" dst_ip="192.207.7.38" dst_port="45124"/>
        </slice>
        <from usec="0" sec="1533705120"/>
        <to usec="0" sec="1533705166"/>
    </anomaly>
    <anomaly type="anomalous" value="1.67961,1.59312,999,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="23.253.136.119" dst_ip="203.161.113.216" dst_port="53"/>
        </slice>
        <from usec="0" sec="1533705210"/>
        <to usec="0" sec="1533705256"/>
    </anomaly>
    <anomaly type="anomalous" value="1.67961,1.59312,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.141.109.204" dst_port="23"/>
        </slice>
        <from usec="0" sec="1533705210"/>
        <to usec="0" sec="1533705256"/>
    </anomaly>
    <anomaly type="anomalous" value="1.66642,1.40745,999,0 0 0 1 1 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.161.115.43"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.16526,1.73978,010,1 1 1 1 0 0 1 1 1 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="5.181.153.109" src_port="33929" dst_port="5900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.67063,2.01325,901,1 1 1 1 1 1 1 1 0 1 1 1,empty">
        <slice/>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.01878,1.62806,503,1 1 0 0 0 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.161.116.86" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.44405,1.29141,010,1 1 1 1 0 0 0 0 0 1 1 0,ntscSYN139445">
        <slice>
            <filter src_ip="206.190.210.60" src_port="44770" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.3981,1.86999,010,1 1 1 1 1 1 1 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="146.185.38.28" src_port="55349" dst_port="13614"/>
            <filter src_ip="187.176.117.236" src_port="31025" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.20406,1.12729,504,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="202.52.106.177" dst_port="443"/>
            <filter src_ip="163.213.248.169" dst_ip="52.248.64.242" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.16211,1.71524,999,1 0 0 1 1 1 0 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="159.94.90.44" dst_port="53413"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.41697,1.87038,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="146.185.38.26" src_port="47512" dst_port="14844"/>
            <filter src_ip="146.185.38.26" src_port="47512" dst_port="14843"/>
            <filter src_ip="146.185.38.26" src_port="47512" dst_port="14842"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.14017,1.72563,999,0 0 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.161.115.43"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.29211,1.25209,999,0 0 0 0 0 0 1 1 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.161.127.59" src_port="53"/>
            <filter dst_ip="203.161.127.59" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.28079,1.23831,011,1 1 1 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="187.176.117.236" src_port="22" dst_port="31025"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.26766,1.75986,504,1 1 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="216.54.197.222" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.20406,1.12729,504,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.213.124.167" src_port="443"/>
            <filter dst_ip="203.161.123.49" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.16238,1.15327,010,0 0 0 0 0 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="146.185.38.55" src_port="40930" dst_port="3477"/>
            <filter src_ip="146.185.38.55" src_port="40930" dst_port="3475"/>
            <filter src_ip="146.185.38.55" src_port="40930" dst_port="3476"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.66642,1.40745,504,0 0 0 1 1 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="133.141.181.9" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.87267,1.5304,999,1 1 1 1 1 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="186.16.104.135" dst_ip="203.161.126.249" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.14017,1.72563,010,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="5.15.208.194" src_port="53162"/>
            <filter src_ip="5.180.87.98" src_port="55149"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.14727,1.714,504,1 1 0 1 1 1 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="163.213.114.56" dst_port="443"/>
            <filter dst_ip="118.95.25.89" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.38467,1.19408,504,1 1 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="172.34.93.94" src_port="443"/>
            <filter dst_ip="203.161.107.240" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.69773,2.07392,504,1 0 0 1 1 1 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.52.111.172" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.44239,1.87,504,1 0 0 1 1 1 1 1 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="151.250.67.124" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.26766,1.75986,010,1 1 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="80.159.181.135"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.14017,1.72563,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.213.17.66" src_port="443"/>
            <filter src_ip="74.234.22.79" dst_ip="163.213.124.208" src_port="443"/>
            <filter src_ip="173.193.146.11" dst_ip="163.213.124.208" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.14017,1.72563,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="23.163.52.57" dst_ip="163.213.1.66"/>
            <filter src_ip="23.163.52.57" src_port="443"/>
            <filter dst_ip="163.213.1.66" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.72686,1.54012,999,0 0 0 0 0 0 1 1 1 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.213.128.94" src_port="53"/>
            <filter dst_ip="163.213.128.93" src_port="53"/>
            <filter dst_ip="163.213.128.122" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.01316,1.62169,504,1 0 0 1 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter dst_ip="203.161.121.46" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.72686,1.54012,020,0 0 0 0 0 0 1 1 1 1 1 0,icmp_error">
        <slice>
            <filter dst_ip="203.161.126.52" src_port="53"/>
            <filter dst_ip="203.161.126.52"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35146,1.19347,503,1 1 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_port="80"/>
            <filter dst_ip="111.210.29.193" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.20406,1.12729,503,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.161.116.86" src_port="80"/>
            <filter src_ip="163.213.249.60" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
