<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="anomalous" value="1.50412,1.30908,999,1 1 1 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="133.101.38.90" dst_ip="98.121.177.3" src_port="42518" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.3273,1.29281,503,1 1 1 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="163.30.86.166" dst_port="443"/>
            <filter src_ip="163.30.86.166" dst_ip="51.140.214.201" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.50412,1.30908,503,1 1 1 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="133.138.36.23" dst_port="25"/>
            <filter src_ip="23.171.203.177" dst_ip="133.138.36.23" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.64323,1.9202,999,1 1 1 1 1 1 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.74.45.104" dst_ip="206.220.228.63"/>
            <filter src_ip="203.74.45.104" dst_ip="204.190.50.46"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.54565,1.85335,010,1 1 0 1 1 1 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="185.72.207.7" src_port="41449" dst_port="24115"/>
            <filter src_ip="185.72.207.7" src_port="41449" dst_port="24117"/>
            <filter src_ip="185.72.207.7" src_port="41449" dst_port="24116"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.21974,1.80597,504,0 0 0 1 1 1 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.30.85.92" src_port="443"/>
        </slice>
        <from usec="0" sec="1546318806"/>
        <to usec="0" sec="1546319536"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4031,1.78111,010,0 0 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="185.39.190.195" src_port="32767"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78808,1.56517,999,1 1 1 0 0 0 1 1 1 1 1 0,ptmp">
        <slice>
            <filter src_ip="37.73.231.179" src_port="5083"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.68826,1.60662,999,1 1 1 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.74.39.89" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546319699"/>
    </anomaly>
    <anomaly type="anomalous" value="1.40906,1.39102,999,0 0 0 0 0 0 1 1 1 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.74.35.206" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.90209,2.11319,503,1 1 1 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.74.45.168" dst_port="80"/>
            <filter dst_ip="203.74.36.47" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.23143,1.20849,999,0 0 0 1 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="203.74.40.157" dst_ip="109.58.76.220" src_port="8333"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.51497,1.33274,010,1 1 1 0 0 0 1 0 0 1 1 1,dntscSYN">
        <slice>
            <filter dst_port="52869"/>
            <filter src_ip="176.141.4.205" src_port="42368" dst_port="56916"/>
            <filter src_ip="176.141.4.205" src_port="42368" dst_port="56914"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.3273,1.29281,502,1 1 1 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="58.50.175.89" dst_port="22"/>
            <filter src_ip="122.252.101.48" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.25414,1.69065,999,1 1 1 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="142.162.27.85" dst_port="53413"/>
            <filter src_ip="219.111.19.111" src_port="58313" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.41421,1.28041,999,1 0 0 0 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.74.40.173" src_port="4001"/>
            <filter dst_ip="203.74.40.173" dst_port="1024"/>
            <filter dst_ip="203.74.40.173" dst_port="4001"/>
            <filter src_port="4001" dst_port="1024"/>
            <filter src_port="4001" dst_port="4001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.40906,1.39102,502,0 0 0 0 0 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter dst_ip="122.252.101.28" src_port="22"/>
            <filter dst_ip="112.170.239.111" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4031,1.78111,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter src_ip="13.163.67.68" dst_ip="163.30.84.234" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.57674,1.40615,999,0 0 0 0 0 0 1 1 1 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.74.44.195" dst_port="53"/>
            <filter dst_ip="203.74.44.220" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4031,1.78111,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.30.84.218" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.57674,1.40615,502,0 0 0 0 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="58.50.175.89" src_port="22"/>
            <filter dst_ip="5.95.70.52" dst_port="43996"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4031,1.78111,010,0 0 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="198.236.184.114" src_port="29011"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4031,1.78111,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="31.114.175.88" src_port="443"/>
            <filter dst_ip="163.30.25.61" src_port="443"/>
            <filter dst_ip="163.30.228.176" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.57674,1.40615,503,0 0 0 0 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="51.96.38.245" src_port="53674"/>
            <filter src_ip="192.206.109.95" dst_ip="163.30.51.101" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.68521,1.98765,999,0 0 0 1 1 1 1 1 1 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.6.241.71" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4031,1.78111,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.30.85.253" src_port="443"/>
            <filter dst_ip="163.30.86.243" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.32518,1.20889,503,1 1 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="163.30.85.183" dst_ip="13.228.196.204"/>
            <filter src_ip="163.30.85.183" dst_port="80"/>
            <filter src_ip="163.30.85.183" dst_port="443"/>
            <filter src_ip="163.30.4.248" dst_ip="13.228.196.204" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.50412,1.30908,502,1 1 1 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="146.255.27.34" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4031,1.78111,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.74.45.168" src_port="80"/>
            <filter src_ip="203.74.36.47" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.14102,1.12609,503,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.30.86.166" src_port="443"/>
            <filter dst_ip="163.30.86.166" src_port="80"/>
            <filter dst_ip="163.30.247.220" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4031,1.78111,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.30.85.183" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.7969,1.42041,010,1 1 1 1 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="5.95.176.227" src_port="46421"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.77213,2.01458,010,1 1 1 1 1 1 1 1 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="176.141.4.210" src_port="50076"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.43172,1.25111,010,0 0 0 1 0 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="185.72.207.34" src_port="54109" dst_port="22582"/>
            <filter src_ip="185.72.207.34" src_port="54109" dst_port="22584"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.73161,2.00498,504,1 0 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.30.84.14" src_port="443"/>
            <filter dst_ip="163.30.86.247" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.85811,1.51035,504,0 0 0 1 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.30.128.232" src_port="443"/>
            <filter dst_ip="163.30.86.226" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.85811,1.51035,504,0 0 0 1 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.230.189.242" src_port="443"/>
            <filter dst_ip="203.74.52.109" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.30.84.100" dst_ip="67.101.14.57" src_port="59248" dst_port="80"/>
        </slice>
        <from usec="0" sec="1546319438"/>
        <to usec="0" sec="1546319458"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.24.36.226" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546318895"/>
        <to usec="0" sec="1546318946"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="125.207.174.54" dst_port="102"/>
        </slice>
        <from usec="0" sec="1546319624"/>
        <to usec="0" sec="1546319686"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,503,1 1 1 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="46.234.108.121" dst_ip="203.74.39.146"/>
            <filter src_ip="46.234.108.121" dst_port="80"/>
            <filter dst_ip="203.74.39.146" dst_port="80"/>
        </slice>
        <from usec="0" sec="1546319086"/>
        <to usec="0" sec="1546319504"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="203.74.52.109" dst_port="22"/>
        </slice>
        <from usec="0" sec="1546319501"/>
        <to usec="0" sec="1546319504"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="111.90.136.70" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546319487"/>
        <to usec="0" sec="1546319532"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.54.241.78" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546319107"/>
        <to usec="0" sec="1546319174"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="119.219.77.131" dst_port="22"/>
        </slice>
        <from usec="0" sec="1546318973"/>
        <to usec="0" sec="1546318976"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="177.101.26.92" dst_port="22"/>
        </slice>
        <from usec="0" sec="1546319141"/>
        <to usec="0" sec="1546319547"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.82.103.64" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546319140"/>
        <to usec="0" sec="1546319192"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="139.187.203.247"/>
        </slice>
        <from usec="0" sec="1546318916"/>
        <to usec="0" sec="1546319066"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953121,1.24522,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="222.185.115.191" dst_port="445"/>
        </slice>
        <from usec="0" sec="1546318989"/>
        <to usec="0" sec="1546318992"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="62.116.6.133"/>
        </slice>
        <from usec="0" sec="1546318955"/>
        <to usec="0" sec="1546318957"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="159.53.37.38"/>
        </slice>
        <from usec="0" sec="1546319387"/>
        <to usec="0" sec="1546319388"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="119.93.109.129" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546319438"/>
        <to usec="0" sec="1546319458"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="203.74.52.109" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546318834"/>
        <to usec="0" sec="1546318902"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="37.73.231.186" src_port="5064" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1546319625"/>
        <to usec="0" sec="1546319649"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="192.186.245.39"/>
        </slice>
        <from usec="0" sec="1546319554"/>
        <to usec="0" sec="1546319556"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.95.81.108" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546319091"/>
        <to usec="0" sec="1546319159"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.80.92.248" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546319692"/>
        <to usec="0" sec="1546319697"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="186.155.141.81" dst_port="22"/>
        </slice>
        <from usec="0" sec="1546318991"/>
        <to usec="0" sec="1546318995"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="49.108.23.162" dst_port="445"/>
        </slice>
        <from usec="0" sec="1546319527"/>
        <to usec="0" sec="1546319528"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.80.74.201" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546319656"/>
        <to usec="0" sec="1546319695"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="125.30.191.89" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546319487"/>
        <to usec="0" sec="1546319539"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="61.35.105.97" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546319086"/>
        <to usec="0" sec="1546319137"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="54.73.16.108" dst_port="22"/>
        </slice>
        <from usec="0" sec="1546319347"/>
        <to usec="0" sec="1546319350"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.55.220.120" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546319525"/>
        <to usec="0" sec="1546319576"/>
    </anomaly>
    <anomaly type="suspicious" value="0.953121,1.24522,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.57.1.140" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546319600"/>
        <to usec="0" sec="1546319668"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="36.23.46.82" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546319502"/>
        <to usec="0" sec="1546319553"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="153.48.243.174" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546319294"/>
        <to usec="0" sec="1546319312"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="61.35.149.185" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546318802"/>
        <to usec="0" sec="1546318832"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.57.139.233" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546319669"/>
        <to usec="0" sec="1546319699"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.125.44.225" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546319668"/>
        <to usec="0" sec="1546319698"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="74.94.80.100" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546318803"/>
        <to usec="0" sec="1546318819"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.249.88.202"/>
        </slice>
        <from usec="0" sec="1546319356"/>
        <to usec="0" sec="1546319357"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="128.9.20.13"/>
        </slice>
        <from usec="0" sec="1546319451"/>
        <to usec="0" sec="1546319452"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="37.129.222.56"/>
        </slice>
        <from usec="0" sec="1546319444"/>
        <to usec="0" sec="1546319445"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="203.74.52.109"/>
        </slice>
        <from usec="0" sec="1546319084"/>
        <to usec="0" sec="1546319086"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18942,1.3427,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.223.33.248"/>
        </slice>
        <from usec="0" sec="1546319199"/>
        <to usec="0" sec="1546319200"/>
    </anomaly>
    <anomaly type="suspicious" value="0.993848,1.21212,999,1 1 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="202.6.241.0" src_port="25"/>
            <filter dst_ip="202.6.241.0" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0814,1.26171,011,0 0 0 1 0 0 0 0 0 0 0 0,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="51.96.38.235" dst_port="53146"/>
            <filter dst_ip="51.96.38.235"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318908"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0814,1.26171,011,0 0 0 1 0 0 0 0 0 0 0 0,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="176.141.4.214"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318908"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0814,1.26171,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.30.1.202"/>
        </slice>
        <from usec="0" sec="1546318801"/>
        <to usec="0" sec="1546319088"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0814,1.26171,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="109.7.8.2"/>
        </slice>
        <from usec="0" sec="1546318802"/>
        <to usec="0" sec="1546319176"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0814,1.26171,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.30.84.156"/>
        </slice>
        <from usec="0" sec="1546318812"/>
        <to usec="0" sec="1546319098"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0814,1.26171,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="180.161.14.108"/>
        </slice>
        <from usec="0" sec="1546318803"/>
        <to usec="0" sec="1546319444"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0814,1.26171,020,0 0 0 1 0 0 0 0 0 0 0 0,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="195.235.51.117" src_port="81"/>
            <filter dst_ip="195.235.51.117"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546319538"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0814,1.26171,010,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="180.93.59.107"/>
        </slice>
        <from usec="0" sec="1546318820"/>
        <to usec="0" sec="1546319536"/>
    </anomaly>
    <anomaly type="suspicious" value="1.37468,1.46138,020,1 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="185.170.176.217"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="142.162.27.85" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.30.163.97" dst_port="53"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.30.107.172" src_port="30303" dst_port="30303"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.115.177.73" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="203.74.44.195" dst_ip="192.8.42.191" dst_port="53"/>
            <filter src_ip="203.74.41.50" dst_ip="192.8.42.191" dst_port="53"/>
            <filter src_ip="203.74.41.51" dst_ip="192.8.42.191" dst_port="53"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.115.177.26" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.11.32.78" src_port="53"/>
            <filter dst_ip="202.11.32.78" dst_port="53"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.74.42.244" src_port="53"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,020,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.30.225.34" src_port="53"/>
            <filter dst_ip="163.30.225.34"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.30.224.156" src_port="53"/>
            <filter dst_ip="163.30.224.156"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.43.48.153" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.43.48.138" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.115.178.73" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546319476"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31063,1.40893,504,0 0 0 0 0 0 1 1 1 1 0 0,alphfl">
        <slice>
            <filter src_ip="202.230.189.242" dst_ip="52.243.253.195" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,020,0 0 0 0 0 0 1 1 1 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="203.74.45.248"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.115.178.5" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.74.33.235" dst_port="53"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318891"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.43.49.42" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31063,1.40893,010,0 0 0 0 0 0 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="150.43.49.53" dst_port="54756"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.949225,1.28818,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.170.179.9" src_port="5321"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.43.164.52" dst_port="23"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.40323,1.43328,999,1 0 0 0 0 0 1 1 1 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="61.119.97.109" dst_ip="203.74.36.37" dst_port="443"/>
            <filter src_ip="61.119.97.109" dst_ip="203.74.36.37" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28002,1.4375,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.74.34.98" dst_port="53"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318891"/>
    </anomaly>
    <anomaly type="suspicious" value="0.969744,1.30194,010,0 0 0 0 0 0 0 0 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.43.74.202"/>
        </slice>
        <from usec="0" sec="1546318800"/>
        <to usec="0" sec="1546318846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31063,1.40893,504,0 0 0 0 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="163.30.139.49" dst_port="443"/>
            <filter dst_ip="52.243.181.180" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.895127,1.10714,504,1 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.30.86.179" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04085,1.12311,010,0 0 0 0 0 0 1 0 0 1 1 1,ntscSYN139445">
        <slice>
            <filter src_ip="193.167.21.40" src_port="58917" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04085,1.12311,010,0 0 0 0 0 0 1 0 0 1 1 1,ntscSYN139445">
        <slice>
            <filter src_ip="193.167.21.107" src_port="58845" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.74.40.158" src_port="8333"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.895127,1.10714,504,1 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="163.30.66.126" dst_ip="198.206.131.101" src_port="3326" dst_port="443"/>
            <filter src_ip="163.30.66.126" dst_ip="198.206.131.101" src_port="3122" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="109.58.76.220" dst_ip="203.74.40.157" dst_port="8333"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,999,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.74.40.173" src_port="1024"/>
            <filter src_ip="203.74.40.173" src_port="4001"/>
            <filter src_ip="203.74.40.173" dst_port="4001"/>
            <filter src_port="1024" dst_port="4001"/>
            <filter src_port="4001" dst_port="4001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="217.200.58.109" dst_port="23"/>
            <filter src_ip="217.200.58.109" src_port="27541" dst_port="52869"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,010,0 0 0 0 0 0 0 0 0 1 1 0,poscaSYN">
        <slice>
            <filter src_ip="114.159.220.187" src_port="60000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="133.101.168.46" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="133.115.177.23" dst_ip="31.187.114.13" src_port="23"/>
            <filter src_ip="133.115.177.23" dst_ip="178.67.42.195" src_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,504,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="118.246.238.220" dst_ip="163.30.84.155" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="142.162.141.217" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="159.182.174.68" dst_ip="203.74.46.51" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.30.85.91" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="173.51.41.233" dst_ip="119.120.41.151" src_port="443" dst_port="56158"/>
            <filter src_ip="173.51.41.233" dst_ip="119.120.41.151" src_port="443" dst_port="56057"/>
            <filter src_ip="173.51.41.233" dst_ip="119.120.41.151" src_port="443" dst_port="55985"/>
            <filter src_ip="173.51.41.233" dst_ip="119.120.41.151" src_port="443" dst_port="55974"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,010,0 0 0 0 0 0 0 0 0 1 1 1,sntscSYN">
        <slice>
            <filter src_ip="188.168.16.138" dst_port="137"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04085,1.12311,010,0 0 0 0 0 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="176.141.4.235" src_port="48670" dst_port="22535"/>
            <filter src_ip="176.141.4.235" src_port="48670" dst_port="22534"/>
            <filter src_ip="176.141.4.235" src_port="48670" dst_port="22536"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="188.168.48.112" src_port="21719" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.11715,1.23609,010,0 0 0 0 0 0 1 1 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="104.211.83.177" src_port="32767" dst_port="8545"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="193.107.186.254" dst_port="11211"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,999,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="195.235.58.16" dst_ip="133.115.177.20"/>
            <filter src_ip="195.235.58.16" src_port="80"/>
            <filter dst_ip="133.115.177.14" src_port="80"/>
            <filter dst_ip="133.115.177.20" dst_port="23"/>
            <filter src_ip="195.235.58.16" dst_ip="133.115.177.14" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,010,0 0 0 0 0 0 0 0 0 1 1 1,sntscSYN">
        <slice>
            <filter src_ip="196.40.47.66" src_port="64438" dst_port="443"/>
            <filter src_ip="196.40.47.66" src_port="60891" dst_port="8088"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,999,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="79.218.16.93" dst_ip="74.94.159.167" src_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.30.85.66" src_port="443"/>
            <filter src_ip="93.88.223.162" dst_ip="163.30.85.66" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,010,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="46.110.233.71" src_port="6765" dst_port="23"/>
            <filter src_ip="46.110.233.71" src_port="19837" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,999,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="46.234.101.138" dst_ip="203.74.40.158" src_port="8333" dst_port="49438"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="66.215.188.141" src_port="29011"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="69.177.197.84" dst_ip="203.74.39.218" src_port="50128" dst_port="4500"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,999,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.74.35.212"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="71.137.221.69" src_port="29011"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.2223,1.31206,010,1 1 1 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="163.30.47.159" dst_port="23"/>
            <filter src_ip="157.218.203.174" src_port="39018" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,504,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="74.94.148.86" dst_ip="163.30.85.45" src_port="443" dst_port="43404"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.74.41.109" src_port="443"/>
            <filter src_ip="203.74.41.109" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22446,1.26378,010,1 0 0 0 0 0 1 1 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="111.227.35.157" dst_port="16923"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="203.74.46.51" dst_ip="159.182.174.68" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.30.86.179" src_port="443"/>
            <filter dst_ip="163.30.81.84" src_port="443"/>
            <filter dst_ip="163.30.84.250" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.74.36.39" src_port="443"/>
            <filter dst_ip="203.74.36.39" dst_port="29560"/>
            <filter dst_ip="163.30.86.239" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.30.86.222" src_port="443"/>
            <filter dst_ip="163.30.84.25" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,999,0 0 0 0 0 0 0 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.30.197.162" src_port="30303" dst_port="30303"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.30.212.221" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,020,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.74.42.100"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.74.41.118" src_port="80"/>
            <filter dst_ip="203.74.41.118" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="163.30.86.166" dst_ip="51.140.179.77" src_port="60845" dst_port="80"/>
            <filter src_ip="163.30.86.166" dst_ip="51.140.179.77" src_port="60844" dst_port="80"/>
            <filter src_ip="163.30.86.166" dst_ip="51.140.179.77" src_port="60826" dst_port="80"/>
            <filter src_ip="163.30.86.166" dst_ip="51.140.179.77" src_port="60825" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,011,0 0 0 0 0 0 0 0 0 1 1 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="5.95.70.50" dst_port="43585"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="202.230.189.242" dst_ip="52.33.19.98" src_port="46602" dst_port="443"/>
            <filter src_ip="202.230.189.242" dst_ip="52.33.19.98" src_port="10944" dst_port="443"/>
            <filter src_ip="163.30.85.225" dst_ip="52.33.19.98" src_port="49292" dst_port="443"/>
            <filter src_ip="163.30.86.176" dst_ip="52.33.19.98" src_port="58807" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="163.30.85.225" dst_ip="5.57.172.240" dst_port="443"/>
            <filter src_ip="163.30.84.128" dst_ip="5.57.172.240" dst_port="443"/>
            <filter src_ip="202.230.189.242" dst_ip="5.57.172.240" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.30.84.14" dst_port="443"/>
            <filter src_ip="163.30.84.14" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.895127,1.10714,504,1 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="202.230.189.242" dst_ip="13.228.223.193" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.741592,1.07543,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="163.30.85.40" dst_ip="66.114.190.179" src_port="9305" dst_port="9305"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,011,0 0 0 0 0 0 0 0 0 1 1 1,point_to_point">
        <slice>
            <filter src_ip="203.74.39.218" dst_ip="185.62.37.76" src_port="8545"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.025,1.09492,011,0 0 0 0 0 0 0 0 0 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="163.80.47.178" dst_port="55742"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
