<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="212.47.48.255" src_port="6000" dst_port="139"/>
        </slice>
        <from usec="0" sec="1544591261"/>
        <to usec="0" sec="1544591264"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="42.81.168.90"/>
        </slice>
        <from usec="0" sec="1544591160"/>
        <to usec="0" sec="1544591161"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="163.180.71.74" src_port="5166" dst_port="5080"/>
        </slice>
        <from usec="0" sec="1544591539"/>
        <to usec="0" sec="1544591701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="143.3.170.146" src_port="2790" dst_port="23"/>
            <filter src_ip="143.3.170.146" src_port="3302" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544590838"/>
        <to usec="0" sec="1544591497"/>
    </anomaly>
    <anomaly type="suspicious" value="1.33612,1.43507,504,1 1 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="163.221.189.194" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,503,1 1 1 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="175.51.185.75" dst_ip="163.221.213.96" src_port="59626" dst_port="80"/>
            <filter src_ip="175.51.185.75" dst_ip="163.221.213.96" src_port="59558" dst_port="80"/>
            <filter src_ip="192.124.54.253" dst_ip="163.221.213.96" src_port="41647" dst_port="80"/>
        </slice>
        <from usec="0" sec="1544591322"/>
        <to usec="0" sec="1544591324"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,999,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="4.156.1.206" dst_ip="163.221.98.166" dst_port="53"/>
            <filter src_ip="213.41.124.140" dst_ip="163.221.98.166" dst_port="53"/>
        </slice>
        <from usec="0" sec="1544591680"/>
        <to usec="0" sec="1544591689"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28699,1.51257,502,1 1 1 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="58.12.106.162" dst_port="22"/>
        </slice>
        <from usec="0" sec="1544590899"/>
        <to usec="0" sec="1544591590"/>
    </anomaly>
    <anomaly type="suspicious" value="1.33612,1.43507,010,1 1 0 0 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.160.150.171" src_port="50487" dst_port="60001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.160.188.58" src_port="6000" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1544591312"/>
        <to usec="0" sec="1544591314"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="37.205.243.72" src_port="5202" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1544591159"/>
        <to usec="0" sec="1544591164"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="128.141.167.146"/>
        </slice>
        <from usec="0" sec="1544591119"/>
        <to usec="0" sec="1544591121"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="37.119.130.159"/>
        </slice>
        <from usec="0" sec="1544590869"/>
        <to usec="0" sec="1544590870"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="129.55.26.41"/>
        </slice>
        <from usec="0" sec="1544590818"/>
        <to usec="0" sec="1544591256"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="107.189.216.219"/>
        </slice>
        <from usec="0" sec="1544591583"/>
        <to usec="0" sec="1544591585"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="62.139.242.129"/>
        </slice>
        <from usec="0" sec="1544590960"/>
        <to usec="0" sec="1544591225"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.243.160.83"/>
        </slice>
        <from usec="0" sec="1544591139"/>
        <to usec="0" sec="1544591141"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="153.61.127.123" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544591133"/>
        <to usec="0" sec="1544591170"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="208.19.99.134" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544591264"/>
        <to usec="0" sec="1544591313"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.62.228.18" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544591539"/>
        <to usec="0" sec="1544591591"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="180.187.21.96" dst_port="22"/>
        </slice>
        <from usec="0" sec="1544590902"/>
        <to usec="0" sec="1544590904"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="111.204.228.213" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544591310"/>
        <to usec="0" sec="1544591376"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="202.205.234.41" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1544591358"/>
        <to usec="0" sec="1544591360"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="143.3.178.18" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544590803"/>
        <to usec="0" sec="1544590833"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="24.137.120.166" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544590899"/>
        <to usec="0" sec="1544590951"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.73.229.62" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544590810"/>
        <to usec="0" sec="1544590839"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="36.200.37.83" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544591424"/>
        <to usec="0" sec="1544591475"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.67.161.230" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544590928"/>
        <to usec="0" sec="1544591008"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.63.199.122" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544590805"/>
        <to usec="0" sec="1544590839"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="133.11.95.74" dst_port="22"/>
        </slice>
        <from usec="0" sec="1544591526"/>
        <to usec="0" sec="1544591532"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="180.130.105.6" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544590901"/>
        <to usec="0" sec="1544590962"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="144.4.7.70" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544591490"/>
        <to usec="0" sec="1544591534"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.74.181.84" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544591236"/>
        <to usec="0" sec="1544591287"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28699,1.51257,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="184.152.82.23" dst_port="20"/>
        </slice>
        <from usec="0" sec="1544590915"/>
        <to usec="0" sec="1544591206"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="111.205.227.214" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544591530"/>
        <to usec="0" sec="1544591581"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.58.239.17" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544591659"/>
        <to usec="0" sec="1544591698"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="61.6.249.228" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544591494"/>
        <to usec="0" sec="1544591545"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28699,1.51257,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="104.128.127.227" dst_port="20"/>
        </slice>
        <from usec="0" sec="1544590986"/>
        <to usec="0" sec="1544591266"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="36.198.47.247" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544591154"/>
        <to usec="0" sec="1544591206"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="61.6.108.36" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544591314"/>
        <to usec="0" sec="1544591365"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.68.49.234" dst_port="23"/>
        </slice>
        <from usec="0" sec="1544590912"/>
        <to usec="0" sec="1544590979"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="118.170.221.31"/>
        </slice>
        <from usec="0" sec="1544591517"/>
        <to usec="0" sec="1544591519"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="172.191.223.57"/>
        </slice>
        <from usec="0" sec="1544591254"/>
        <to usec="0" sec="1544591255"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.91.226.35"/>
        </slice>
        <from usec="0" sec="1544591111"/>
        <to usec="0" sec="1544591112"/>
    </anomaly>
    <anomaly type="suspicious" value="1.177,1.48279,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="31.51.193.231"/>
        </slice>
        <from usec="0" sec="1544590854"/>
        <to usec="0" sec="1544591176"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07217,1.4684,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1544590800"/>
        <to usec="0" sec="1544591628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05878,1.44202,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.221.119.37" dst_ip="52.249.144.99" dst_port="443"/>
            <filter src_ip="163.221.119.37" dst_ip="52.115.139.187" dst_port="443"/>
        </slice>
        <from usec="0" sec="1544590806"/>
        <to usec="0" sec="1544591178"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05878,1.44202,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="52.11.250.102" dst_ip="163.221.118.179" src_port="443" dst_port="55803"/>
        </slice>
        <from usec="0" sec="1544591090"/>
        <to usec="0" sec="1544591170"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05878,1.44202,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.221.189.6" dst_port="443"/>
        </slice>
        <from usec="0" sec="1544590800"/>
        <to usec="0" sec="1544591337"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05878,1.44202,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.30.235.190" dst_port="443"/>
        </slice>
        <from usec="0" sec="1544590866"/>
        <to usec="0" sec="1544591358"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05878,1.44202,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.221.1.112" dst_port="443"/>
            <filter src_ip="163.221.1.112" dst_port="80"/>
        </slice>
        <from usec="0" sec="1544590800"/>
        <to usec="0" sec="1544591446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05878,1.44202,020,0 0 0 1 1 0 0 0 0 0 0 0,ptpDoSIC">
        <slice>
            <filter src_ip="77.153.41.161" dst_ip="203.178.130.50"/>
        </slice>
        <from usec="0" sec="1544590803"/>
        <to usec="0" sec="1544591445"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17984,1.47262,999,0 0 0 1 1 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.221.208.90" src_port="53"/>
            <filter dst_ip="163.221.208.92" src_port="53"/>
            <filter dst_ip="163.221.208.116" src_port="53"/>
            <filter dst_ip="163.221.208.95" src_port="53"/>
        </slice>
        <from usec="0" sec="1544590866"/>
        <to usec="0" sec="1544591513"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05878,1.44202,012,0 0 0 1 1 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.30.244.114" dst_ip="60.242.152.189" dst_port="80"/>
            <filter src_ip="133.30.244.114" dst_ip="59.255.105.226" dst_port="80"/>
        </slice>
        <from usec="0" sec="1544591092"/>
        <to usec="0" sec="1544591443"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05878,1.44202,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="125.33.160.180" dst_ip="203.178.138.239" src_port="45828" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1544590800"/>
        <to usec="0" sec="1544591538"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05878,1.44202,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.11.95.23" dst_ip="142.93.167.32" src_port="23"/>
        </slice>
        <from usec="0" sec="1544590800"/>
        <to usec="0" sec="1544591628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05878,1.44202,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="196.75.203.19" src_port="52172" dst_port="118"/>
            <filter src_ip="196.75.203.19" src_port="62074" dst_port="1025"/>
            <filter src_ip="196.75.203.19" src_port="59485" dst_port="3052"/>
        </slice>
        <from usec="0" sec="1544590800"/>
        <to usec="0" sec="1544591628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05878,1.44202,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="183.62.169.93" dst_ip="163.221.188.176" src_port="993"/>
        </slice>
        <from usec="0" sec="1544591103"/>
        <to usec="0" sec="1544591613"/>
    </anomaly>
    <anomaly type="suspicious" value="1.5646,1.70265,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1544590800"/>
        <to usec="0" sec="1544591448"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17984,1.47262,504,0 0 0 1 1 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="210.141.83.15" dst_ip="163.221.122.174" src_port="443"/>
        </slice>
        <from usec="0" sec="1544590907"/>
        <to usec="0" sec="1544591354"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07529,1.42236,502,0 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="133.30.63.149"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.19467,1.45338,999,0 0 0 0 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="203.178.135.242"/>
            <filter src_ip="139.82.13.62" dst_port="1935"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06194,1.39511,010,0 0 0 1 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="155.166.253.209" src_port="42169" dst_port="3386"/>
            <filter src_ip="155.166.253.209" src_port="42169" dst_port="3387"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07529,1.42236,010,0 0 0 0 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="54.228.209.125" src_port="48293" dst_port="41161"/>
            <filter src_ip="54.228.209.125" src_port="48293" dst_port="41162"/>
            <filter src_ip="54.228.209.125" src_port="48293" dst_port="41163"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06194,1.39511,999,0 0 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="133.30.136.185" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.60656,1.82595,999,1 1 1 1 1 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.178.134.247" dst_ip="206.220.247.1"/>
            <filter src_ip="203.178.134.247" dst_ip="204.197.238.6"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.35005,1.75317,503,1 1 0 1 0 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.178.140.169" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92753,1.54742,999,1 1 1 0 0 0 0 0 0 1 1 0,ntscUDPOther">
        <slice>
            <filter src_ip="176.7.61.213" src_port="5073" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.53617,1.49578,503,1 1 1 0 0 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="203.178.159.233" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.68177,1.86903,010,1 1 1 1 1 1 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="58.37.18.96" dst_port="7777"/>
            <filter src_ip="36.9.65.234" dst_port="3389"/>
            <filter src_ip="5.128.108.55" src_port="54767"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.52466,1.51448,011,1 1 1 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="212.47.48.255" src_port="139" dst_port="6000"/>
            <filter dst_ip="176.7.61.213"/>
        </slice>
        <from usec="0" sec="1544590801"/>
        <to usec="0" sec="1544591627"/>
    </anomaly>
    <anomaly type="anomalous" value="2.36444,1.76631,504,0 0 0 1 1 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="17.251.174.0" dst_ip="163.221.191.25" src_port="443"/>
            <filter src_ip="17.251.174.0" dst_ip="163.221.119.14" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.84044,1.73032,020,0 0 0 1 1 1 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="203.178.135.219" dst_ip="195.8.22.105"/>
        </slice>
        <from usec="0" sec="1544590800"/>
        <to usec="0" sec="1544591538"/>
    </anomaly>
    <anomaly type="anomalous" value="1.84044,1.73032,999,0 0 0 1 1 1 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.221.132.83" dst_port="443"/>
            <filter src_ip="163.221.132.83" dst_port="5938"/>
        </slice>
        <from usec="0" sec="1544590800"/>
        <to usec="0" sec="1544591538"/>
    </anomaly>
    <anomaly type="anomalous" value="1.84044,1.73032,999,0 0 0 1 1 1 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="74.221.22.160" dst_ip="163.221.81.41" src_port="19302"/>
            <filter src_ip="74.221.22.160" dst_ip="163.221.63.245" src_port="19302"/>
            <filter src_ip="74.221.22.160" dst_ip="163.221.98.176" src_port="19302"/>
            <filter src_ip="74.221.22.160" dst_ip="163.221.190.49" src_port="19302"/>
        </slice>
        <from usec="0" sec="1544590803"/>
        <to usec="0" sec="1544591533"/>
    </anomaly>
    <anomaly type="anomalous" value="1.84044,1.73032,010,0 0 0 1 1 1 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="49.84.137.36" dst_port="443"/>
        </slice>
        <from usec="0" sec="1544590800"/>
        <to usec="0" sec="1544591628"/>
    </anomaly>
    <anomaly type="anomalous" value="1.84044,1.73032,999,0 0 0 1 1 1 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.30.148.106" dst_port="53"/>
        </slice>
        <from usec="0" sec="1544590820"/>
        <to usec="0" sec="1544591591"/>
    </anomaly>
    <anomaly type="anomalous" value="3.05473,2.08276,999,1 1 1 1 1 1 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="185.17.98.35" src_port="1007" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.88986,1.71368,503,1 0 0 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="172.33.102.56" dst_port="443"/>
            <filter src_ip="172.33.102.56" dst_port="80"/>
        </slice>
        <from usec="0" sec="1544590800"/>
        <to usec="0" sec="1544591268"/>
    </anomaly>
    <anomaly type="anomalous" value="3.05473,2.08276,504,1 1 1 1 1 1 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="202.20.39.42" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4471,1.81081,504,0 0 0 1 1 1 1 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="172.33.102.197" dst_ip="202.20.39.42" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.199,1.72267,999,1 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.178.138.244"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4031,1.75002,504,1 0 0 1 1 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="23.44.239.252" dst_ip="163.221.183.244" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.53617,1.49578,504,1 1 1 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="202.158.106.2" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.19251,1.70023,504,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="23.44.239.157" src_port="443"/>
            <filter dst_ip="163.221.77.25" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.14305,4.15895,504,1 1 1 1 1 1 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.20.39.42" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.58487,1.47657,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="14.15.209.130" src_port="80"/>
            <filter src_ip="14.15.209.130" dst_ip="163.221.189.35" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.46928,1.8032,010,1 1 1 1 0 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="104.128.118.160" dst_port="20"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.88307,2.01652,504,1 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.26.210.161" src_port="53"/>
            <filter dst_ip="202.26.210.161" src_port="443"/>
            <filter dst_ip="202.26.210.133" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.15669,1.73922,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="17.251.174.2" dst_ip="163.221.191.25" src_port="443" dst_port="55304"/>
            <filter src_ip="17.251.174.2" dst_ip="163.221.191.25" src_port="443" dst_port="55301"/>
            <filter src_ip="17.251.174.2" dst_ip="163.221.190.114" src_port="443" dst_port="56828"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.01004,2.06123,503,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.178.134.79" src_port="80"/>
            <filter src_ip="203.178.140.169" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.58487,1.47657,999,0 0 0 0 0 0 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="204.197.238.6" dst_ip="203.178.134.247"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.25346,1.72627,504,1 0 0 1 0 0 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="52.199.194.72" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.58487,1.47657,010,0 0 0 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="36.65.32.115" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.80706,4.02965,504,0 0 0 1 1 1 1 1 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="202.158.106.2" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.97646,1.51893,504,1 0 0 1 1 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.221.148.144" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.36444,1.76631,504,0 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="17.253.251.254" src_port="443"/>
            <filter dst_ip="163.221.47.206" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.25346,1.72627,504,1 0 0 1 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.178.159.233" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.6596,1.48077,504,0 0 0 1 0 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.221.166.187" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
