<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="suspicious" value="0.99242,1.17147,504,1 1 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="133.227.3.51" dst_port="443"/>
            <filter dst_ip="162.90.198.185" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.26384,1.33642,999,1 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="72.70.54.10" dst_ip="203.206.140.197" dst_port="53"/>
            <filter src_ip="35.77.226.89" dst_ip="203.206.140.197" dst_port="53"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539148467"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,999,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="45.139.46.143" dst_ip="203.206.140.74" src_port="32802" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539148208"/>
        <to usec="0" sec="1539148209"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="195.230.211.121" src_port="43425" dst_port="5080"/>
        </slice>
        <from usec="0" sec="1539147686"/>
        <to usec="0" sec="1539148102"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="123.184.140.35" dst_port="123"/>
        </slice>
        <from usec="0" sec="1539148394"/>
        <to usec="0" sec="1539148398"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.218.189.177" dst_ip="174.123.15.61" src_port="43074" dst_port="80"/>
        </slice>
        <from usec="0" sec="1539147696"/>
        <to usec="0" sec="1539147771"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,504,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="131.78.54.241" dst_ip="87.19.190.149" src_port="1347" dst_port="443"/>
        </slice>
        <from usec="0" sec="1539148220"/>
        <to usec="0" sec="1539148223"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="92.58.173.2" src_port="36943" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1539147958"/>
        <to usec="0" sec="1539148246"/>
    </anomaly>
    <anomaly type="suspicious" value="0.886277,1.18321,010,1 0 1 0 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.193.166.97" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.796593,1.19379,010,1 0 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="111.56.187.88" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539147827"/>
        <to usec="0" sec="1539147878"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="59.110.104.121" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539147707"/>
        <to usec="0" sec="1539148400"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="111.93.32.73"/>
        </slice>
        <from usec="0" sec="1539147824"/>
        <to usec="0" sec="1539148229"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.164.96.35"/>
        </slice>
        <from usec="0" sec="1539148298"/>
        <to usec="0" sec="1539148379"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="52.89.6.109"/>
        </slice>
        <from usec="0" sec="1539147815"/>
        <to usec="0" sec="1539148263"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.128.187.60" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539147937"/>
        <to usec="0" sec="1539147967"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="118.66.89.8" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539148144"/>
        <to usec="0" sec="1539148211"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="61.111.70.237" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539147841"/>
        <to usec="0" sec="1539147893"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="36.14.182.182" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539147917"/>
        <to usec="0" sec="1539147968"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.26.175.78" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539147795"/>
        <to usec="0" sec="1539147846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.39.154.73" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539148354"/>
        <to usec="0" sec="1539148421"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="45.177.18.74"/>
        </slice>
        <from usec="0" sec="1539147884"/>
        <to usec="0" sec="1539147885"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="36.1.70.177" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539148435"/>
        <to usec="0" sec="1539148475"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="36.4.135.96" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539148208"/>
        <to usec="0" sec="1539148259"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.25.3.253" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539147931"/>
        <to usec="0" sec="1539147983"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.203.24.177" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539147693"/>
        <to usec="0" sec="1539147744"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="111.50.181.180" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539148264"/>
        <to usec="0" sec="1539148315"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.206.26.174" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539147914"/>
        <to usec="0" sec="1539147981"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,502,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="118.152.240.72" dst_port="22"/>
        </slice>
        <from usec="0" sec="1539147796"/>
        <to usec="0" sec="1539147800"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="173.14.44.106" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539148148"/>
        <to usec="0" sec="1539148200"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.195.166.137" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539147815"/>
        <to usec="0" sec="1539147867"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="36.8.106.7" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539148467"/>
        <to usec="0" sec="1539148498"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="111.57.67.118" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539147819"/>
        <to usec="0" sec="1539147857"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="172.135.81.121"/>
        </slice>
        <from usec="0" sec="1539148153"/>
        <to usec="0" sec="1539148154"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,999,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.227.1.16" dst_ip="74.6.137.94" src_port="38524" dst_port="25"/>
        </slice>
        <from usec="0" sec="1539148210"/>
        <to usec="0" sec="1539148212"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,503,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="116.177.163.80" dst_ip="17.157.72.35" src_port="80" dst_port="60830"/>
        </slice>
        <from usec="0" sec="1539147833"/>
        <to usec="0" sec="1539147846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="163.218.127.125" dst_port="80"/>
            <filter src_ip="163.218.127.125" dst_port="443"/>
        </slice>
        <from usec="0" sec="1539147693"/>
        <to usec="0" sec="1539148481"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="17.157.72.35" dst_port="443"/>
            <filter src_ip="17.157.72.35" dst_ip="116.177.163.80" dst_port="80"/>
        </slice>
        <from usec="0" sec="1539147836"/>
        <to usec="0" sec="1539148498"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,502,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.218.45.28" dst_ip="163.218.137.20" src_port="61230" dst_port="22"/>
            <filter src_ip="163.218.45.28" dst_ip="163.218.137.20" src_port="61229" dst_port="22"/>
            <filter src_ip="163.218.45.28" dst_ip="163.218.137.20" src_port="61228" dst_port="22"/>
            <filter src_ip="163.218.45.28" dst_ip="163.218.137.20" src_port="61223" dst_port="22"/>
        </slice>
        <from usec="0" sec="1539147815"/>
        <to usec="0" sec="1539147882"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.43.231.115" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539148177"/>
        <to usec="0" sec="1539148179"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="42.146.230.186"/>
        </slice>
        <from usec="0" sec="1539147779"/>
        <to usec="0" sec="1539148412"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="211.102.190.81" src_port="6000" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1539148195"/>
        <to usec="0" sec="1539148197"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="49.187.190.50" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539148159"/>
        <to usec="0" sec="1539148208"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.46.143.170" dst_port="23"/>
        </slice>
        <from usec="0" sec="1539148466"/>
        <to usec="0" sec="1539148499"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08038,1.27499,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539148428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.24369,1.30472,010,0 0 0 1 1 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="185.230.57.134" src_port="49025" dst_port="32311"/>
            <filter src_ip="185.230.57.134" src_port="49025" dst_port="5405"/>
            <filter src_ip="185.230.57.134" src_port="49025" dst_port="8100"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539147708"/>
    </anomaly>
    <anomaly type="suspicious" value="1.24369,1.30472,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="202.56.155.133" dst_ip="150.43.92.148" src_port="8839" dst_port="5555"/>
            <filter src_ip="202.56.155.133" dst_ip="133.244.107.114" src_port="16161" dst_port="5555"/>
            <filter src_ip="202.56.155.133" dst_ip="163.218.97.158" src_port="44098" dst_port="53544"/>
            <filter src_ip="202.56.155.133" dst_ip="133.112.57.213" src_port="2687" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539147798"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08038,1.27499,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539148428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25,1.28273,999,1 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.218.53.233" dst_ip="40.107.155.1" src_port="57150" dst_port="143"/>
            <filter src_ip="163.218.53.233" dst_ip="40.107.155.1" src_port="57138" dst_port="143"/>
            <filter src_ip="163.218.53.233" dst_ip="40.107.155.1" src_port="57112" dst_port="143"/>
            <filter src_ip="163.218.53.233" dst_ip="40.107.155.1" src_port="57111" dst_port="143"/>
        </slice>
        <from usec="0" sec="1539147601"/>
        <to usec="0" sec="1539148440"/>
    </anomaly>
    <anomaly type="suspicious" value="1.14592,1.30523,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539148428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.14592,1.30523,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539148338"/>
    </anomaly>
    <anomaly type="suspicious" value="0.871652,1.16307,999,1 1 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.206.128.216" dst_port="53"/>
        </slice>
        <from usec="0" sec="1539147690"/>
        <to usec="0" sec="1539147736"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25761,1.35754,502,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="61.63.231.28" src_port="22"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539147646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25761,1.35754,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.206.134.209" dst_port="53"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539147646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25761,1.35754,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.206.137.28" dst_port="53"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539147646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25761,1.35754,504,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.218.227.65" src_port="443"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539147646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25761,1.35754,020,0 0 0 0 0 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.206.140.59" dst_port="53"/>
            <filter dst_ip="203.206.140.59"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539148096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25761,1.35754,999,0 0 0 0 0 0 1 1 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="202.247.167.204" dst_ip="203.206.128.70" dst_port="53"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539147646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25761,1.35754,504,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.218.4.102" src_port="443"/>
            <filter dst_ip="163.218.4.102" src_port="80"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539147646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.1297,1.34573,504,0 0 0 0 0 0 0 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="8.130.10.120"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539147646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07274,1.15814,999,0 0 0 0 0 0 1 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.218.190.100" src_port="53"/>
            <filter dst_ip="163.218.191.87" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.938576,1.23571,011,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="116.31.69.249" src_port="22" dst_port="9090"/>
        </slice>
        <from usec="0" sec="1539148143"/>
        <to usec="0" sec="1539148145"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08005,1.13331,504,1 0 0 0 0 0 1 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="167.79.153.16" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.805371,1.13253,999,0 0 0 0 0 0 1 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.218.191.99" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08005,1.13331,504,1 0 0 0 0 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="202.189.61.52" src_port="443"/>
            <filter src_ip="208.78.33.48" dst_ip="202.189.61.52" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919468,1.14428,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="202.180.197.39" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31625,1.34824,504,0 0 0 0 0 0 1 1 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.218.78.96" src_port="443"/>
            <filter src_ip="1.14.255.26" dst_ip="163.218.78.96" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.99242,1.17147,503,1 1 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="5.91.223.46" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919468,1.14428,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="101.119.142.1" dst_ip="203.206.143.15" src_port="22805" dst_port="8333"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919468,1.14428,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="118.18.101.125" dst_ip="203.206.130.229" src_port="60802" dst_port="39004"/>
            <filter src_ip="118.18.101.125" dst_ip="203.206.130.229" src_port="60801" dst_port="3010"/>
            <filter src_ip="118.18.101.125" dst_ip="203.206.130.229" src_port="60800" dst_port="37781"/>
            <filter src_ip="118.18.101.125" dst_ip="203.206.130.229" src_port="60799" dst_port="3010"/>
            <filter src_ip="118.18.101.125" dst_ip="203.206.130.230"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919468,1.14428,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="163.218.97.15" dst_port="443"/>
            <filter src_ip="163.218.97.15" dst_ip="202.156.141.205" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919468,1.14428,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="185.161.36.40" dst_ip="203.206.143.15" src_port="55416" dst_port="8333"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919468,1.14428,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="109.237.246.10" dst_ip="202.180.197.39" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919468,1.14428,502,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="125.190.201.48" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919468,1.14428,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="202.189.61.79" dst_ip="126.6.28.254" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07274,1.15814,504,0 0 0 0 0 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.218.227.61" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08005,1.13331,503,1 0 0 0 0 0 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.218.98.59" src_port="80"/>
            <filter dst_ip="163.218.98.59" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919468,1.14428,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="203.206.143.15" dst_ip="218.173.156.9" src_port="8333" dst_port="57908"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919468,1.14428,999,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="203.206.143.15" dst_ip="54.100.141.49" src_port="8333"/>
            <filter src_ip="203.206.143.13" dst_ip="54.100.141.49" src_port="8333"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919468,1.14428,011,0 0 0 0 0 0 0 0 0 1 1 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="5.91.206.9" dst_port="53710"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.064,1.19717,503,0 0 0 0 0 0 0 0 0 1 0 1,mptmp">
        <slice>
            <filter src_ip="117.239.8.3" src_port="80"/>
            <filter dst_ip="202.189.37.48" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.00231,1.55392,504,1 1 1 1 1 1 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.180.197.15" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.67351,1.46477,011,1 1 1 1 0 0 1 1 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="27.71.244.186" src_port="22" dst_port="40182"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.48743,1.77882,999,1 1 1 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="176.86.135.5" src_port="43233"/>
            <filter src_ip="108.206.189.188" src_port="48662" dst_port="1900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.63327,1.45948,504,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="13.78.198.214" dst_ip="163.218.74.176" src_port="443" dst_port="61799"/>
        </slice>
        <from usec="0" sec="1539148168"/>
        <to usec="0" sec="1539148407"/>
    </anomaly>
    <anomaly type="anomalous" value="1.63327,1.45948,010,0 0 0 1 1 1 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="85.162.157.125" src_port="53843"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539148158"/>
    </anomaly>
    <anomaly type="anomalous" value="1.72422,1.47037,504,0 0 0 1 1 1 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.218.45.57" src_port="443"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539148338"/>
    </anomaly>
    <anomaly type="anomalous" value="1.63807,1.43985,503,1 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.206.136.81" dst_port="80"/>
        </slice>
        <from usec="0" sec="1539147620"/>
        <to usec="0" sec="1539148499"/>
    </anomaly>
    <anomaly type="anomalous" value="1.84474,1.46137,504,0 0 0 1 0 0 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.58.58" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.10489,1.52351,504,1 0 0 1 1 1 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.206.135.46" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.55251,2.04454,504,1 0 0 1 0 0 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.189.61.12" src_port="53"/>
            <filter dst_ip="202.189.61.12" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.47387,2.03969,504,0 0 0 0 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="172.93.106.63" dst_ip="202.180.197.15"/>
            <filter src_ip="172.93.106.63" src_port="443"/>
            <filter dst_ip="202.180.197.227" src_port="443"/>
            <filter dst_ip="202.180.197.15" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.27838,1.22142,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="17.157.72.55" src_port="443"/>
            <filter dst_ip="163.218.226.27" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.72422,1.47037,999,0 0 0 1 1 1 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="163.218.126.165" src_port="30303"/>
            <filter dst_ip="163.218.126.165" dst_port="30303"/>
            <filter src_port="30303" dst_port="30303"/>
            <filter src_ip="38.70.197.143" dst_ip="163.218.126.165" src_port="48067"/>
        </slice>
        <from usec="0" sec="1539148026"/>
        <to usec="0" sec="1539148157"/>
    </anomaly>
    <anomaly type="anomalous" value="3.04694,2.2947,504,1 1 1 1 1 1 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.180.197.15" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.16652,1.97166,503,1 0 0 0 0 0 1 1 1 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="202.180.197.39" dst_ip="52.109.65.134" dst_port="80"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539148179"/>
    </anomaly>
    <anomaly type="anomalous" value="2.16289,1.98604,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="203.206.128.36" dst_ip="64.7.4.249" dst_port="53"/>
            <filter src_ip="203.206.128.35" dst_ip="64.7.4.249" dst_port="53"/>
            <filter src_ip="203.206.128.34" dst_ip="64.7.4.249" dst_port="53"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539147646"/>
    </anomaly>
    <anomaly type="anomalous" value="2.16289,1.98604,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.206.137.10" dst_port="53"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539147646"/>
    </anomaly>
    <anomaly type="anomalous" value="2.16289,1.98604,011,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="107.69.10.115" src_port="953"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539147646"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39833,1.21115,504,1 0 0 0 0 0 1 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="172.93.106.63" dst_ip="202.180.197.15" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.02719,1.53168,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.206.128.103" src_port="443"/>
            <filter src_ip="1.14.255.26" dst_ip="203.206.128.103" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.28451,1.1979,999,1 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="203.206.130.229" src_port="3010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.04694,2.2947,010,1 1 1 1 1 1 1 1 1 1 1 1,ptmp">
        <slice>
            <filter src_ip="122.83.110.195"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.25908,1.62145,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="58.218.134.180" src_port="6000" dst_port="2375"/>
            <filter src_ip="221.133.190.162" src_port="9090" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.16262,1.55657,504,1 1 0 1 1 1 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.206.142.225" src_port="443"/>
            <filter dst_ip="203.206.142.225" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92668,1.51987,504,1 1 1 0 0 0 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="133.227.181.106" src_port="443"/>
            <filter dst_ip="133.227.181.106" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.23587,1.2054,504,1 0 0 1 0 0 0 0 0 1 0 1,mptp">
        <slice>
            <filter dst_ip="163.218.127.36" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.02719,1.53168,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.99.19" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.19045,1.61157,504,1 1 1 1 1 1 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="23.209.237.126" dst_ip="163.218.78.89" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.28451,1.1979,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.223.25" src_port="443"/>
            <filter dst_ip="163.218.223.25" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.25908,1.62145,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="116.31.69.249" src_port="9090" dst_port="22"/>
            <filter src_ip="27.71.244.186" src_port="40182" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.52409,1.32022,999,1 1 1 0 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.206.136.247" dst_ip="206.156.226.142"/>
            <filter src_ip="203.206.136.247" dst_ip="204.197.221.158"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.63327,1.45948,504,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.218.225.110" dst_ip="52.145.2.5" dst_port="443"/>
        </slice>
        <from usec="0" sec="1539147600"/>
        <to usec="0" sec="1539148416"/>
    </anomaly>
    <anomaly type="anomalous" value="1.27838,1.22142,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.118.183" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.28451,1.1979,503,1 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="5.91.223.46" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.28451,1.1979,999,1 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.206.130.214"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.28451,1.1979,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.225.136" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.02719,1.53168,999,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.206.130.214"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.27838,1.22142,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="13.79.25.28" dst_ip="5.91.223.46" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.10489,1.52351,010,1 0 0 1 1 1 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="172.93.106.43" dst_port="52869"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.10489,1.52351,504,1 0 0 1 1 1 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.189.61.52" src_port="443"/>
            <filter src_ip="208.78.33.48" dst_ip="202.189.61.52" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.27838,1.22142,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="23.194.130.180" dst_ip="163.218.227.78" src_port="443" dst_port="6723"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.27838,1.22142,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="60.143.101.205" dst_ip="203.206.130.229" src_port="64806" dst_port="34965"/>
            <filter src_ip="60.143.101.205" dst_ip="203.206.130.229" src_port="64803" dst_port="33580"/>
            <filter src_ip="60.143.101.205" dst_ip="203.206.130.230"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
