<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="suspicious" value="0.727267,1.05196,503,1 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="163.189.231.140" dst_port="443"/>
            <filter src_ip="163.189.231.140" dst_ip="13.100.252.47" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.189.158.89" dst_ip="198.249.48.109" src_port="61091" dst_port="80"/>
            <filter src_ip="163.189.158.89" dst_ip="198.249.48.109" src_port="61076" dst_port="80"/>
            <filter src_ip="163.189.158.89" dst_ip="198.249.48.109" src_port="61063" dst_port="80"/>
            <filter src_ip="163.189.158.89" dst_ip="198.249.48.109" src_port="61049" dst_port="80"/>
        </slice>
        <from usec="0" sec="1536469207"/>
        <to usec="0" sec="1536469985"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="46.26.55.202" dst_ip="203.114.128.145" dst_port="80"/>
        </slice>
        <from usec="0" sec="1536469369"/>
        <to usec="0" sec="1536469432"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="42.82.175.155"/>
        </slice>
        <from usec="0" sec="1536469404"/>
        <to usec="0" sec="1536470078"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="159.32.205.166"/>
        </slice>
        <from usec="0" sec="1536469464"/>
        <to usec="0" sec="1536469465"/>
    </anomaly>
    <anomaly type="suspicious" value="0.869728,1.1322,504,1 1 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="202.11.36.111" dst_port="443"/>
            <filter dst_ip="111.69.29.57" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.869728,1.1322,503,1 1 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="104.60.126.174" dst_ip="163.189.157.54" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870485,1.17774,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="151.98.65.226" dst_ip="163.189.107.16" src_port="14961" dst_port="3395"/>
        </slice>
        <from usec="0" sec="1536469273"/>
        <to usec="0" sec="1536469768"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,504,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.114.133.195" dst_port="443"/>
        </slice>
        <from usec="0" sec="1536469410"/>
        <to usec="0" sec="1536469973"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.202.167.94" src_port="5167" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1536469534"/>
        <to usec="0" sec="1536469535"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="221.21.131.169" src_port="6000" dst_port="80"/>
        </slice>
        <from usec="0" sec="1536469432"/>
        <to usec="0" sec="1536469433"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="125.162.225.129" src_port="6000" dst_port="8090"/>
            <filter src_ip="125.162.225.129" src_port="6000" dst_port="8089"/>
            <filter src_ip="125.162.225.129" src_port="6000" dst_port="8080"/>
            <filter src_ip="125.162.225.129" src_port="6000" dst_port="89"/>
            <filter src_ip="125.162.225.129" src_port="6000" dst_port="80"/>
        </slice>
        <from usec="0" sec="1536469341"/>
        <to usec="0" sec="1536469343"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870485,1.17774,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="62.101.132.124" src_port="5076" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1536469236"/>
        <to usec="0" sec="1536469238"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="191.144.73.243"/>
        </slice>
        <from usec="0" sec="1536469735"/>
        <to usec="0" sec="1536469736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="172.159.161.166"/>
        </slice>
        <from usec="0" sec="1536469917"/>
        <to usec="0" sec="1536469918"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="155.71.33.112"/>
        </slice>
        <from usec="0" sec="1536469444"/>
        <to usec="0" sec="1536470093"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="50.116.238.87"/>
        </slice>
        <from usec="0" sec="1536469756"/>
        <to usec="0" sec="1536470055"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="93.56.190.248" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1536469856"/>
        <to usec="0" sec="1536469857"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="203.114.147.238" src_port="6000" dst_port="4899"/>
        </slice>
        <from usec="0" sec="1536469557"/>
        <to usec="0" sec="1536469558"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870485,1.17774,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="216.56.130.1" dst_port="23"/>
        </slice>
        <from usec="0" sec="1536469863"/>
        <to usec="0" sec="1536469914"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="45.132.91.140" dst_port="23"/>
        </slice>
        <from usec="0" sec="1536469590"/>
        <to usec="0" sec="1536469634"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.27.86.114" dst_port="23"/>
        </slice>
        <from usec="0" sec="1536469201"/>
        <to usec="0" sec="1536469238"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="36.236.248.30" dst_port="23"/>
        </slice>
        <from usec="0" sec="1536469495"/>
        <to usec="0" sec="1536469546"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="14.104.200.193" dst_port="445"/>
        </slice>
        <from usec="0" sec="1536469609"/>
        <to usec="0" sec="1536469610"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870485,1.17774,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="117.247.94.89" dst_port="23"/>
        </slice>
        <from usec="0" sec="1536469940"/>
        <to usec="0" sec="1536469985"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="213.202.113.106" dst_port="23"/>
        </slice>
        <from usec="0" sec="1536469340"/>
        <to usec="0" sec="1536469391"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="36.232.209.96" dst_port="23"/>
        </slice>
        <from usec="0" sec="1536469477"/>
        <to usec="0" sec="1536469544"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="59.92.49.91" dst_port="23"/>
        </slice>
        <from usec="0" sec="1536469369"/>
        <to usec="0" sec="1536469413"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.111.95.69" dst_port="23"/>
        </slice>
        <from usec="0" sec="1536469201"/>
        <to usec="0" sec="1536469266"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="118.108.191.79" dst_port="23"/>
        </slice>
        <from usec="0" sec="1536469203"/>
        <to usec="0" sec="1536469233"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="91.160.111.84" dst_port="23"/>
        </slice>
        <from usec="0" sec="1536469749"/>
        <to usec="0" sec="1536469794"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="116.88.121.209" dst_port="445"/>
        </slice>
        <from usec="0" sec="1536469576"/>
        <to usec="0" sec="1536469586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870485,1.17774,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="107.160.57.51" dst_port="1080"/>
        </slice>
        <from usec="0" sec="1536469562"/>
        <to usec="0" sec="1536469669"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="104.160.43.16"/>
        </slice>
        <from usec="0" sec="1536469655"/>
        <to usec="0" sec="1536469656"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18534,1.29157,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.67.30.27"/>
        </slice>
        <from usec="0" sec="1536469547"/>
        <to usec="0" sec="1536469549"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870485,1.17774,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="107.160.57.51" src_port="1080"/>
        </slice>
        <from usec="0" sec="1536469619"/>
        <to usec="0" sec="1536469669"/>
    </anomaly>
    <anomaly type="suspicious" value="0.779913,1.08348,504,1 0 0 1 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="163.189.156.32" dst_ip="116.71.27.49" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780757,1.13097,999,1 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.114.133.249" src_port="53"/>
        </slice>
        <from usec="0" sec="1536469226"/>
        <to usec="0" sec="1536469441"/>
    </anomaly>
    <anomaly type="suspicious" value="1.27753,1.32344,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.197.162.250" dst_ip="185.99.50.114" src_port="3389"/>
        </slice>
        <from usec="0" sec="1536469201"/>
        <to usec="0" sec="1536469483"/>
    </anomaly>
    <anomaly type="suspicious" value="1.27753,1.32344,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="117.251.4.77" src_port="61042" dst_port="23"/>
        </slice>
        <from usec="0" sec="1536469204"/>
        <to usec="0" sec="1536469668"/>
    </anomaly>
    <anomaly type="suspicious" value="1.14855,1.31648,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1536469200"/>
        <to usec="0" sec="1536470028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.14855,1.31648,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1536469200"/>
        <to usec="0" sec="1536470028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.27657,1.40335,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1536469200"/>
        <to usec="0" sec="1536470028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.27657,1.40335,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1536469200"/>
        <to usec="0" sec="1536470028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.818052,1.19514,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="159.162.0.46" dst_port="52869"/>
        </slice>
        <from usec="0" sec="1536469200"/>
        <to usec="0" sec="1536469246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.818052,1.19514,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.114.136.48" dst_port="53"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469336"/>
    </anomaly>
    <anomaly type="suspicious" value="0.818052,1.19514,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.114.131.187"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469336"/>
    </anomaly>
    <anomaly type="suspicious" value="0.868323,1.17213,020,1 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="81.126.126.90"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469398"/>
    </anomaly>
    <anomaly type="suspicious" value="0.818052,1.19514,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.203.252.170"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469336"/>
    </anomaly>
    <anomaly type="suspicious" value="0.818052,1.19514,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.11.36.81" src_port="53"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469336"/>
    </anomaly>
    <anomaly type="suspicious" value="0.818052,1.19514,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.189.51.223" src_port="53"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469336"/>
    </anomaly>
    <anomaly type="suspicious" value="0.818052,1.19514,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.189.51.226" src_port="53"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469336"/>
    </anomaly>
    <anomaly type="suspicious" value="0.818052,1.19514,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.189.51.224" src_port="53"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469336"/>
    </anomaly>
    <anomaly type="suspicious" value="0.818052,1.19514,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.189.80.122" dst_port="53"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469381"/>
    </anomaly>
    <anomaly type="suspicious" value="0.818052,1.19514,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="185.86.72.209" src_port="65535" dst_port="8889"/>
            <filter src_ip="185.86.72.209" src_port="65535" dst_port="8890"/>
            <filter src_ip="185.86.72.209" src_port="65535" dst_port="8900"/>
        </slice>
        <from usec="0" sec="1536469515"/>
        <to usec="0" sec="1536469561"/>
    </anomaly>
    <anomaly type="suspicious" value="0.818052,1.19514,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="146.254.33.248"/>
        </slice>
        <from usec="0" sec="1536469965"/>
        <to usec="0" sec="1536470011"/>
    </anomaly>
    <anomaly type="suspicious" value="1.23729,1.37365,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.203.253.181" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1536469830"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919649,1.25473,010,0 0 0 0 0 0 0 0 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.203.253.165" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1536469830"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919649,1.25473,999,0 0 0 0 0 0 0 0 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.189.51.217" src_port="53"/>
        </slice>
        <from usec="0" sec="1536469830"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919649,1.25473,999,0 0 0 0 0 0 0 0 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.189.51.216" src_port="53"/>
        </slice>
        <from usec="0" sec="1536469830"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919649,1.25473,999,0 0 0 0 0 0 0 0 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.189.51.223" src_port="53"/>
        </slice>
        <from usec="0" sec="1536469830"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919649,1.25473,999,0 0 0 0 0 0 0 0 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.189.51.226" src_port="53"/>
        </slice>
        <from usec="0" sec="1536469830"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919649,1.25473,999,0 0 0 0 0 0 0 0 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.189.51.224" src_port="53"/>
        </slice>
        <from usec="0" sec="1536469830"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="suspicious" value="1.30668,1.42579,011,0 0 0 0 0 0 0 1 1 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="93.56.190.248" src_port="52869"/>
        </slice>
        <from usec="0" sec="1536469830"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="suspicious" value="0.727267,1.05196,503,1 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="163.189.156.199" dst_ip="12.225.145.42" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.727267,1.05196,504,1 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.189.157.217" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.03409,1.14029,999,1 1 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="203.114.143.0" src_port="8333"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870094,1.08604,504,0 0 0 1 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="107.23.103.20" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.727267,1.05196,504,1 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="202.11.36.211" dst_ip="162.124.68.91" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.817247,1.1503,999,0 0 0 0 0 0 1 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.189.51.220" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.817247,1.1503,999,0 0 0 0 0 0 1 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.189.51.221" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.14095,1.25791,999,0 0 0 0 0 0 1 0 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.189.51.225" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870094,1.08604,999,0 0 0 1 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="181.183.192.86" src_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870094,1.08604,504,0 0 0 1 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="203.114.131.163" dst_ip="42.106.190.151" src_port="443" dst_port="14599"/>
            <filter src_ip="203.114.131.163" dst_ip="42.106.190.151" src_port="443" dst_port="8928"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.727267,1.05196,503,1 0 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="163.189.116.234" dst_port="80"/>
            <filter src_ip="163.189.116.234" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00214,1.11517,010,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="51.217.17.197" src_port="48093"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00214,1.11517,010,0 0 0 0 0 0 0 0 0 1 1 1,sntscSYN">
        <slice>
            <filter src_ip="139.225.84.105" dst_port="1755"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.870094,1.08604,999,0 0 0 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.189.51.225" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00214,1.11517,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="168.163.94.28" dst_ip="163.189.156.244" src_port="8000" dst_port="54815"/>
            <filter src_ip="168.163.94.28" dst_ip="163.189.156.14" src_port="8000" dst_port="54165"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00214,1.11517,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.114.147.239" src_port="443"/>
            <filter dst_ip="203.114.147.239" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04358,1.09047,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.189.156.199" src_port="443"/>
            <filter dst_ip="163.189.157.73" src_port="443"/>
            <filter src_ip="12.225.145.42" dst_ip="163.189.156.199" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.727267,1.05196,503,1 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.114.133.195" src_port="443"/>
            <filter dst_ip="203.114.133.195" src_port="80"/>
            <filter src_ip="1.210.249.114" dst_ip="203.114.133.195" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04358,1.09047,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.189.157.99" src_port="443"/>
            <filter dst_ip="163.189.156.107" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00214,1.11517,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.189.156.40" src_port="443"/>
            <filter dst_ip="163.189.156.40" src_port="993"/>
            <filter dst_ip="163.189.127.244" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00214,1.11517,010,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="51.217.17.114" src_port="52919"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00214,1.11517,502,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="54.130.34.53" dst_ip="203.114.139.17" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04358,1.09047,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04358,1.09047,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.11.36.111" src_port="443"/>
            <filter dst_ip="163.189.158.22" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00214,1.11517,999,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="88.156.225.194" dst_ip="114.1.193.149" src_port="8333" dst_port="42152"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04358,1.09047,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00214,1.11517,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.189.158.70" src_port="443"/>
            <filter src_ip="202.36.157.157" dst_ip="163.189.158.70" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.727267,1.05196,502,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="203.114.147.239" dst_port="22"/>
            <filter src_ip="58.68.92.104" dst_ip="203.114.139.37"/>
            <filter src_ip="58.68.92.104" dst_ip="203.114.147.239"/>
            <filter src_ip="58.68.92.104" dst_port="22"/>
            <filter dst_ip="203.114.139.37" dst_port="22"/>
            <filter dst_ip="203.114.147.239" dst_port="22"/>
            <filter dst_ip="203.114.141.129" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00214,1.11517,999,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.114.135.58"/>
            <filter src_ip="203.114.135.35"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00214,1.11517,011,0 0 0 0 0 0 0 0 0 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="151.172.149.107" src_port="443" dst_port="56445"/>
            <filter dst_ip="151.172.149.107" src_port="63389" dst_port="56445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.44727,1.27563,010,1 1 1 0 0 0 1 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="201.59.121.193" src_port="6000" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.27956,1.23047,502,1 1 1 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="149.235.211.246" dst_ip="203.137.23.137" dst_port="22"/>
            <filter src_ip="149.235.211.246" dst_ip="163.189.234.13" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.64352,1.87562,010,1 1 1 1 1 1 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="133.107.228.175" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.62934,1.30757,502,1 1 1 0 0 0 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.114.143.25" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.27956,1.23047,503,1 1 1 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="163.189.156.33" dst_ip="67.38.194.46" dst_port="80"/>
            <filter src_ip="163.189.156.33" dst_ip="67.38.207.63" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36468,1.33466,010,1 1 1 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="103.72.14.24" src_port="22" dst_port="22"/>
        </slice>
        <from usec="0" sec="1536469563"/>
        <to usec="0" sec="1536469696"/>
    </anomaly>
    <anomaly type="anomalous" value="2.24396,1.63923,010,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="146.254.33.208" dst_port="207"/>
            <filter src_ip="81.126.126.90" dst_port="5060"/>
            <filter src_ip="187.115.186.251" src_port="39941" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.74638,1.55103,010,0 0 0 1 1 1 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="148.117.85.253" dst_port="445"/>
        </slice>
        <from usec="0" sec="1536469200"/>
        <to usec="0" sec="1536469937"/>
    </anomaly>
    <anomaly type="anomalous" value="1.67174,1.39852,504,1 0 0 1 0 0 1 1 1 1 1 0,mptpla">
        <slice>
            <filter src_ip="206.121.6.118" dst_ip="203.114.131.163" dst_port="443"/>
            <filter src_ip="172.140.171.93" dst_ip="203.114.131.163" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47131,1.46494,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.189.80.122" dst_port="53"/>
        </slice>
        <from usec="0" sec="1536469830"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.57406,1.4712,011,0 0 0 1 0 0 1 1 1 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="194.9.255.157" dst_port="57061"/>
        </slice>
        <from usec="0" sec="1536469200"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47131,1.46494,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.114.136.48" dst_port="53"/>
        </slice>
        <from usec="0" sec="1536469830"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47131,1.46494,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.212.160.74" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47131,1.46494,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.114.136.33" dst_port="53"/>
        </slice>
        <from usec="0" sec="1536469830"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47131,1.46494,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.212.160.5" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47131,1.46494,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.11.36.81" src_port="53"/>
            <filter dst_ip="202.11.36.81" dst_port="53"/>
        </slice>
        <from usec="0" sec="1536469830"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47131,1.46494,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.203.128.229" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47131,1.46494,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.203.128.245" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47131,1.46494,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.114.142.128" src_port="53"/>
            <filter dst_ip="203.114.142.128" dst_port="53"/>
        </slice>
        <from usec="0" sec="1536469830"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.60076,1.45257,504,1 0 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="52.22.106.180" dst_port="443"/>
        </slice>
        <from usec="0" sec="1536469201"/>
        <to usec="0" sec="1536470026"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47131,1.46494,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.212.162.170" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47131,1.46494,010,0 0 0 0 0 0 1 1 1 0 0 0,poscaSYN">
        <slice>
            <filter src_ip="45.160.39.33" dst_ip="203.114.128.255" src_port="34404"/>
        </slice>
        <from usec="0" sec="1536469830"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47131,1.46494,020,0 0 0 0 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="203.114.137.52"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47131,1.46494,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.212.162.245" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.4994,1.4094,999,1 0 0 0 0 0 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="203.114.133.249" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47131,1.46494,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.203.129.21" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1536469290"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.57364,1.43501,999,0 0 0 1 0 0 1 1 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.189.29.54" src_port="30303" dst_port="30303"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47131,1.46494,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="52.22.110.194" dst_port="443"/>
        </slice>
        <from usec="0" sec="1536469830"/>
        <to usec="0" sec="1536469876"/>
    </anomaly>
    <anomaly type="anomalous" value="1.67174,1.39852,502,1 0 0 1 0 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter dst_ip="116.31.84.118" src_port="22"/>
            <filter dst_ip="146.254.33.208" src_port="207"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.14146,1.11864,020,1 1 0 1 0 0 0 0 0 1 1 0,ttl_error">
        <slice>
            <filter src_ip="133.197.8.114"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.57364,1.43501,999,0 0 0 1 0 0 1 1 1 1 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="192.27.20.199" dst_ip="203.114.130.42" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54823,1.41137,999,0 0 0 0 0 0 1 1 1 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.114.136.38" src_port="53"/>
            <filter dst_ip="203.114.136.38" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.24396,1.63923,901,1 1 1 1 1 1 0 0 0 1 1 1,empty">
        <slice/>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.98167,1.50985,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.114.137.73" src_port="80"/>
            <filter src_ip="203.114.131.175" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.01865,1.46494,010,1 1 1 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="114.26.220.100" dst_port="554"/>
            <filter src_ip="5.3.144.80" src_port="45687"/>
            <filter src_ip="37.13.185.112" src_port="5473" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.62522,1.29915,503,1 1 0 0 0 0 1 0 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.114.131.175" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.22113,1.64512,010,0 0 0 1 1 1 1 0 1 1 1 1,ptmp">
        <slice>
            <filter src_ip="80.82.130.194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47086,1.42859,999,0 0 0 0 0 0 1 1 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.114.141.13" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54823,1.41137,010,0 0 0 0 0 0 1 1 1 1 1 0,mptp">
        <slice>
            <filter dst_ip="150.203.129.10" dst_port="54756"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54823,1.41137,999,0 0 0 0 0 0 1 1 1 1 1 0,ptmp">
        <slice>
            <filter src_ip="203.114.136.38" src_port="53"/>
            <filter src_ip="203.114.136.38" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.64352,1.87562,999,1 1 1 1 1 1 1 1 1 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.2.205.163" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.83209,1.5472,502,1 1 1 0 0 0 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="203.114.143.25" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.902,1.42579,999,1 1 1 1 1 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.114.137.140" dst_ip="206.187.124.198"/>
            <filter src_ip="203.114.137.140" dst_ip="204.5.210.253"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.1477,1.12339,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.189.157.187" src_port="443"/>
            <filter dst_ip="163.189.157.187" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.09478,1.55113,010,1 1 0 1 1 1 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="185.11.229.143" dst_port="81"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.98167,1.50985,504,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.189.157.52" src_port="443"/>
            <filter dst_ip="163.189.157.56" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.98167,1.50985,504,1 0 0 1 1 1 0 0 0 1 1 1,rflatUDP">
        <slice>
            <filter dst_ip="163.189.158.60" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.09478,1.55113,504,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="216.56.130.130" src_port="443"/>
            <filter dst_ip="163.189.255.154" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.72269,1.31458,010,1 1 1 1 0 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="185.7.31.140" dst_port="207"/>
            <filter src_ip="203.114.147.239" dst_port="1080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.96016,1.52778,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="136.241.159.117" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.64352,1.87562,503,1 1 1 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="52.61.161.70" dst_port="80"/>
            <filter dst_ip="203.114.137.73" dst_port="80"/>
            <filter dst_ip="202.11.32.87" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.1477,1.12339,011,0 0 0 1 0 0 0 0 0 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="185.86.72.209" dst_port="65535"/>
            <filter dst_ip="146.254.33.210" dst_port="44532"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36541,1.26388,504,0 0 0 1 1 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.189.124.223" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.24354,1.14118,504,1 0 0 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="216.56.131.43" src_port="443"/>
            <filter dst_ip="163.189.157.147" src_port="443"/>
            <filter dst_ip="163.189.157.147" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.96016,1.52778,999,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="64.106.34.66" src_port="5222"/>
            <filter dst_ip="163.189.156.20" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.96016,1.52778,010,0 0 0 1 1 1 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="176.119.7.81" src_port="43570" dst_port="8735"/>
            <filter src_ip="176.119.7.81" src_port="43570" dst_port="8736"/>
            <filter src_ip="176.119.7.81" src_port="43570" dst_port="8734"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.18405,1.09887,999,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.114.135.58"/>
            <filter dst_ip="71.109.102.223"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.83162,1.42772,504,1 0 0 1 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.189.157.230" src_port="443"/>
            <filter dst_ip="163.189.116.234" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.18405,1.09887,504,1 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.189.158.103" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.42683,1.21106,504,1 0 0 1 0 0 0 0 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="13.100.253.96" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.24505,1.14694,999,1 1 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="163.189.234.13" dst_ip="149.235.240.118" src_port="161"/>
            <filter src_ip="163.189.234.13" dst_ip="177.88.10.186" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.58441,1.27081,504,1 1 1 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.189.245.220" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.47519,1.74911,504,1 1 1 1 1 1 1 0 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.189.156.200" src_port="443"/>
            <filter dst_ip="163.189.156.200" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.96016,1.52778,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5519,1.2784,504,0 0 0 1 0 0 1 0 1 1 1 1,ptmp">
        <slice>
            <filter src_ip="31.61.110.8" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.18405,1.09887,504,1 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.189.158.52" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.8514,1.36563,010,1 1 0 1 1 0 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="185.51.174.136" src_port="55903"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.64352,1.87562,901,1 1 1 1 1 1 1 1 1 1 1 1,empty">
        <slice/>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.98167,1.50985,010,1 0 0 1 1 1 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="31.184.189.226" src_port="53991" dst_port="32865"/>
            <filter src_ip="31.184.189.226" src_port="53991" dst_port="32864"/>
            <filter src_ip="31.184.189.226" src_port="53991" dst_port="32863"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.18405,1.09887,503,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.189.157.131" src_port="443"/>
            <filter dst_ip="163.189.157.131" src_port="80"/>
            <filter dst_ip="163.189.240.209" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.24505,1.14694,504,1 1 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.189.68.252" src_port="443"/>
            <filter src_ip="117.49.61.118" dst_ip="163.189.131.42" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.34365,1.6734,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="176.119.7.97" src_port="42310"/>
            <filter src_ip="116.31.84.124" src_port="9090" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
