<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="suspicious" value="0.745925,1.04792,504,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="163.205.128.39" src_port="443"/>
            <filter src_ip="198.25.10.6" dst_ip="202.58.166.195" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05954,1.17294,504,1 0 0 0 0 0 0 0 0 0 1 1,mptmp">
        <slice>
            <filter src_ip="172.70.154.176" src_port="443"/>
            <filter dst_ip="202.139.217.49" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08427,1.1531,503,1 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.243.100.171" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08427,1.1531,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.205.131.171" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08427,1.1531,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.205.131.240" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.29651,1.31046,503,1 1 1 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="113.83.55.143" dst_ip="150.196.240.13" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745925,1.04792,504,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="173.195.66.92" src_port="443"/>
            <filter src_ip="74.138.233.25" dst_ip="202.139.219.4" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.826774,1.1538,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="192.31.148.32" dst_ip="163.205.87.97" src_port="443" dst_port="45073"/>
        </slice>
        <from usec="0" sec="1551589910"/>
        <to usec="0" sec="1551589912"/>
    </anomaly>
    <anomaly type="suspicious" value="0.826774,1.1538,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="89.11.160.47" dst_ip="203.243.105.177" src_port="443" dst_port="49969"/>
        </slice>
        <from usec="0" sec="1551589908"/>
        <to usec="0" sec="1551589910"/>
    </anomaly>
    <anomaly type="suspicious" value="0.826774,1.1538,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="205.49.95.4" dst_ip="163.205.131.5" src_port="443" dst_port="62462"/>
        </slice>
        <from usec="0" sec="1551589685"/>
        <to usec="0" sec="1551589687"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,504,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="163.205.131.20" dst_port="443"/>
        </slice>
        <from usec="0" sec="1551589288"/>
        <to usec="0" sec="1551589317"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18254,1.29764,504,1 1 1 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.205.130.204" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.24798,1.37795,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.43.95.61" src_port="47534" dst_port="22"/>
        </slice>
        <from usec="0" sec="1551589380"/>
        <to usec="0" sec="1551589426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.826774,1.1538,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="202.164.206.161" dst_ip="88.225.239.6" src_port="60006" dst_port="80"/>
        </slice>
        <from usec="0" sec="1551589353"/>
        <to usec="0" sec="1551589369"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858237,1.13362,503,1 1 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="140.245.126.137" dst_ip="150.196.240.13" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.826774,1.1538,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="173.195.66.102" dst_ip="163.205.130.223" src_port="443" dst_port="57933"/>
        </slice>
        <from usec="0" sec="1551589585"/>
        <to usec="0" sec="1551589587"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,503,1 1 1 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="150.196.240.13" dst_ip="113.83.55.143" dst_port="80"/>
            <filter src_ip="150.196.240.13" dst_ip="140.245.126.137" dst_port="80"/>
        </slice>
        <from usec="0" sec="1551589259"/>
        <to usec="0" sec="1551590053"/>
    </anomaly>
    <anomaly type="suspicious" value="1.24798,1.37795,504,1 1 1 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="206.138.226.49" dst_ip="203.243.100.166" dst_port="443"/>
        </slice>
        <from usec="0" sec="1551589268"/>
        <to usec="0" sec="1551590053"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="62.59.231.78"/>
        </slice>
        <from usec="0" sec="1551589658"/>
        <to usec="0" sec="1551589757"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.107.14.87"/>
        </slice>
        <from usec="0" sec="1551589255"/>
        <to usec="0" sec="1551589257"/>
    </anomaly>
    <anomaly type="suspicious" value="1.24798,1.37795,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="188.39.220.78" src_port="49868" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1551589920"/>
        <to usec="0" sec="1551589966"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="51.78.136.76" src_port="53369" dst_port="389"/>
        </slice>
        <from usec="0" sec="1551590019"/>
        <to usec="0" sec="1551590053"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.179.144.83"/>
        </slice>
        <from usec="0" sec="1551589644"/>
        <to usec="0" sec="1551589645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.826774,1.1538,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="151.174.82.207" dst_port="445"/>
        </slice>
        <from usec="0" sec="1551589590"/>
        <to usec="0" sec="1551589604"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.238.142.199" dst_port="23"/>
        </slice>
        <from usec="0" sec="1551589632"/>
        <to usec="0" sec="1551589700"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.104.128.23" dst_port="23"/>
        </slice>
        <from usec="0" sec="1551589259"/>
        <to usec="0" sec="1551589326"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="111.123.100.214" dst_port="23"/>
        </slice>
        <from usec="0" sec="1551589835"/>
        <to usec="0" sec="1551589915"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.104.93.252" dst_port="23"/>
        </slice>
        <from usec="0" sec="1551589265"/>
        <to usec="0" sec="1551589317"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="5.237.79.215" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1551590016"/>
        <to usec="0" sec="1551590018"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.230.132.67" dst_port="23"/>
        </slice>
        <from usec="0" sec="1551589659"/>
        <to usec="0" sec="1551589710"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18254,1.29764,010,1 1 1 0 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.184.36.196" dst_port="60001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.234.166.120" dst_port="23"/>
        </slice>
        <from usec="0" sec="1551589877"/>
        <to usec="0" sec="1551589945"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="37.15.134.131"/>
        </slice>
        <from usec="0" sec="1551589255"/>
        <to usec="0" sec="1551589256"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="155.89.48.124"/>
        </slice>
        <from usec="0" sec="1551589642"/>
        <to usec="0" sec="1551589723"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="71.204.54.187"/>
        </slice>
        <from usec="0" sec="1551589283"/>
        <to usec="0" sec="1551589287"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="50.132.233.214"/>
        </slice>
        <from usec="0" sec="1551589600"/>
        <to usec="0" sec="1551590031"/>
    </anomaly>
    <anomaly type="suspicious" value="0.826774,1.1538,004,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="145.142.232.212" src_port="445"/>
        </slice>
        <from usec="0" sec="1551589335"/>
        <to usec="0" sec="1551590041"/>
    </anomaly>
    <anomaly type="suspicious" value="1.29651,1.31046,011,1 1 1 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="222.184.36.196" src_port="60001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18254,1.29764,504,1 1 1 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="152.184.168.54" dst_ip="163.205.131.133" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18254,1.29764,999,1 1 1 0 0 0 0 0 0 1 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.58.180.30" src_port="5349" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="139.159.81.147" src_port="21" dst_port="21"/>
        </slice>
        <from usec="0" sec="1551589259"/>
        <to usec="0" sec="1551589945"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15991,1.3153,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="104.125.191.164"/>
        </slice>
        <from usec="0" sec="1551589320"/>
        <to usec="0" sec="1551589418"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28746,1.33447,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1551589200"/>
        <to usec="0" sec="1551589668"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28746,1.33447,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1551589200"/>
        <to usec="0" sec="1551589668"/>
    </anomaly>
    <anomaly type="suspicious" value="1.32177,1.36239,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1551589200"/>
        <to usec="0" sec="1551589668"/>
    </anomaly>
    <anomaly type="suspicious" value="1.32177,1.36239,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1551589200"/>
        <to usec="0" sec="1551589668"/>
    </anomaly>
    <anomaly type="suspicious" value="1.32177,1.36239,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1551589200"/>
        <to usec="0" sec="1551589668"/>
    </anomaly>
    <anomaly type="suspicious" value="1.32177,1.36239,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1551589200"/>
        <to usec="0" sec="1551589668"/>
    </anomaly>
    <anomaly type="suspicious" value="0.842561,1.16928,999,0 0 0 0 0 0 1 0 0 0 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.205.134.242" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17801,1.22409,010,1 0 0 0 0 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="125.95.175.55" dst_port="8089"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876625,1.12556,010,1 0 0 0 0 0 1 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="121.175.237.169" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.973981,1.20576,503,1 1 0 0 0 0 1 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="203.243.116.28" dst_ip="88.225.239.6" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745925,1.04792,504,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="203.243.116.28"/>
            <filter src_ip="172.70.159.180" src_port="443"/>
            <filter dst_ip="163.205.130.129" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08427,1.1531,504,1 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="163.205.131.16" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745925,1.04792,504,1 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="163.205.130.204" dst_port="443"/>
            <filter src_ip="163.205.130.204" dst_ip="185.85.44.62" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05127,1.21035,504,1 0 0 0 0 0 1 0 0 1 0 1,mptmp">
        <slice>
            <filter src_ip="172.70.153.65" src_port="443"/>
            <filter dst_ip="163.205.244.38" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745925,1.04792,504,1 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="163.205.62.242" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.205.131.50" src_port="443"/>
            <filter src_ip="121.175.237.169" dst_ip="163.205.131.50" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745925,1.04792,504,1 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.205.155.157" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08427,1.1531,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="31.245.51.207" src_port="443"/>
            <filter dst_ip="163.205.131.246" src_port="443"/>
            <filter dst_ip="163.205.131.39" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="209.74.34.21" dst_ip="163.205.130.136" src_port="443" dst_port="64677"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08427,1.1531,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.205.130.187" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08427,1.1531,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="192.154.23.85" src_port="443"/>
            <filter dst_ip="163.205.61.119" src_port="443"/>
            <filter dst_ip="163.205.130.162" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745925,1.04792,504,1 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.205.128.0" src_port="443"/>
            <filter dst_ip="163.205.128.0" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745925,1.04792,010,1 0 0 0 0 0 0 0 0 1 1 0,DDoSSYNACKrp">
        <slice>
            <filter src_ip="122.228.7.14" src_port="30050"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08171,1.17636,011,0 0 0 0 0 0 0 0 0 1 1 1,point_to_point">
        <slice>
            <filter src_ip="203.243.98.202" dst_ip="203.243.116.28"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745925,1.04792,999,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="133.24.227.143" src_port="25"/>
            <filter src_ip="133.24.227.64" dst_ip="198.139.80.236" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,502,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="218.164.152.104" dst_port="22"/>
            <filter dst_ip="203.243.102.164" dst_port="22"/>
            <filter dst_ip="203.243.102.210" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,999,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="133.4.64.95" src_port="23"/>
            <filter src_ip="133.4.64.95" dst_port="80"/>
            <filter dst_ip="217.205.16.48" src_port="23"/>
            <filter dst_ip="217.205.16.48" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745925,1.04792,503,1 0 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="103.200.209.243" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="172.151.85.196" dst_port="143"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.858237,1.13362,503,1 1 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="17.10.158.53" src_port="80"/>
            <filter dst_ip="202.139.219.4" src_port="80"/>
            <filter src_ip="17.10.158.53" dst_ip="202.139.219.4" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="173.195.65.33" dst_ip="163.205.155.134" src_port="443"/>
            <filter src_ip="173.195.65.33" dst_ip="163.205.128.125" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="173.195.66.73" dst_ip="163.205.128.24" src_port="443" dst_port="50689"/>
            <filter src_ip="173.195.66.73" dst_ip="163.205.128.24" src_port="443" dst_port="50687"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="72.134.191.69" dst_ip="163.205.130.110" src_port="80" dst_port="54163"/>
            <filter src_ip="72.134.191.69" dst_ip="203.243.116.28" src_port="443" dst_port="43841"/>
            <filter src_ip="72.134.191.69" dst_ip="203.243.102.220" src_port="443" dst_port="42526"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="23.161.176.4" dst_ip="163.205.130.18" src_port="443" dst_port="50650"/>
            <filter src_ip="23.161.176.4" dst_ip="163.205.130.18" src_port="443" dst_port="50649"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745925,1.04792,504,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="172.70.154.176" src_port="443"/>
            <filter dst_ip="163.205.130.254" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="203.243.98.231" dst_ip="203.243.116.28" src_port="3010" dst_port="40164"/>
            <filter src_ip="203.243.98.231" dst_ip="203.243.116.28" src_port="3010" dst_port="40162"/>
            <filter src_ip="203.243.98.231" dst_ip="203.243.116.28" src_port="3010" dst_port="40160"/>
            <filter src_ip="203.243.98.231" dst_ip="203.243.116.28" src_port="3001" dst_port="56952"/>
            <filter src_ip="203.243.98.231" dst_ip="203.243.116.28"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08171,1.17636,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="163.205.130.56" dst_ip="111.191.20.121" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08171,1.17636,011,0 0 0 0 0 0 0 0 0 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="5.67.241.56" dst_port="58372"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,010,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="133.207.127.6"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="23.242.17.2" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745925,1.04792,504,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="74.138.233.121" dst_ip="163.205.128.47" src_port="443"/>
            <filter src_ip="39.105.212.177" dst_ip="202.139.219.143" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,504,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="216.97.192.142" dst_ip="163.205.62.51" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.745925,1.04792,504,1 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.205.154.49" src_port="443"/>
            <filter src_ip="8.236.8.244" dst_ip="163.205.154.49" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,999,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="163.205.131.124" src_port="9020"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.916562,1.1586,504,1 0 0 0 0 0 0 0 0 0 0 1,mptp">
        <slice>
            <filter dst_ip="163.205.131.50" src_port="443"/>
            <filter src_ip="121.175.237.169" dst_ip="163.205.131.50" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.205.222.29" src_port="443"/>
            <filter src_ip="8.236.8.244" dst_ip="163.205.222.29" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,999,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="203.243.98.216" dst_port="3010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="133.24.226.164" dst_ip="204.209.211.219" src_port="80" dst_port="51136"/>
            <filter src_ip="133.24.226.164" dst_ip="204.209.211.219" src_port="80" dst_port="51134"/>
            <filter src_ip="133.24.226.164" dst_ip="204.209.211.219" src_port="80" dst_port="15704"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.742197,1.07346,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="203.243.111.48" dst_ip="109.178.42.108" src_port="8333"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08427,1.1531,503,1 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.205.131.215" src_port="80"/>
            <filter dst_ip="163.205.131.215" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08171,1.17636,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="78.243.251.240" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08427,1.1531,999,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.205.63.162"/>
            <filter dst_ip="202.139.219.143" src_port="443"/>
            <filter dst_ip="202.139.219.143" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08171,1.17636,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="54.188.145.35" dst_ip="163.205.131.27" src_port="443"/>
            <filter src_ip="54.188.145.35" dst_ip="163.205.157.248" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08427,1.1531,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.205.131.128" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.9421,1.16206,504,0 0 0 0 0 0 0 0 0 1 0 1,ptmpla">
        <slice>
            <filter src_ip="74.138.233.22" dst_ip="163.205.130.187" src_port="443"/>
            <filter src_ip="74.138.233.22" dst_ip="163.205.137.234" src_port="443"/>
            <filter src_ip="74.138.233.22" dst_ip="163.205.130.196" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08171,1.17636,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="74.138.84.102" dst_ip="163.205.128.125" src_port="443" dst_port="47807"/>
            <filter src_ip="74.138.84.102" dst_ip="163.205.128.125" src_port="443" dst_port="38362"/>
            <filter src_ip="74.138.84.102" dst_ip="163.205.128.125" src_port="443" dst_port="38361"/>
            <filter src_ip="74.138.84.102" dst_ip="163.205.128.115" src_port="443" dst_port="40869"/>
            <filter src_ip="74.138.84.102" dst_ip="163.205.131.65" src_port="443" dst_port="51735"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08171,1.17636,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.205.130.153" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08171,1.17636,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="133.24.86.2" dst_ip="185.63.73.147" src_port="443" dst_port="53205"/>
            <filter src_ip="133.24.86.2" dst_ip="185.63.73.147" src_port="443" dst_port="49206"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.58501,1.45518,052,1 1 1 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="112.186.212.109" src_port="22"/>
            <filter dst_ip="209.178.204.241" src_port="22" dst_port="3708"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.58501,1.45518,504,1 1 1 0 0 0 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="202.58.166.195" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.60883,1.98665,011,1 1 1 1 1 1 0 0 0 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="163.172.56.9" src_port="50802" dst_port="151"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.51663,1.396,504,1 1 1 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.205.130.173" src_port="80"/>
            <filter dst_ip="163.205.130.173" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.47311,1.96229,010,1 1 1 1 1 1 1 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="121.175.237.169" dst_port="23"/>
            <filter src_ip="163.172.56.9" src_port="151" dst_port="50802"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.47874,1.88362,503,1 1 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="88.225.239.6" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.42766,1.86985,504,1 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.205.128.123" src_port="80"/>
            <filter dst_ip="163.205.128.123" src_port="443"/>
            <filter dst_ip="163.205.12.202" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.42651,1.88428,010,0 0 0 1 1 1 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="107.21.47.228" dst_port="8090"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.38358,1.82417,504,1 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.205.131.16" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.17281,1.77848,502,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="218.164.152.90" dst_ip="202.129.93.221" dst_port="22"/>
        </slice>
        <from usec="0" sec="1551589201"/>
        <to usec="0" sec="1551589848"/>
    </anomaly>
    <anomaly type="anomalous" value="2.38242,1.83896,504,0 0 0 1 1 1 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="163.205.131.75" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.17281,1.77848,503,0 0 0 1 1 1 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="47.135.99.157" dst_ip="163.205.128.26"/>
            <filter src_ip="47.135.99.157" src_port="80"/>
            <filter dst_ip="163.205.128.26" src_port="443"/>
            <filter dst_ip="163.205.128.26" src_port="80"/>
            <filter src_ip="47.135.99.157" dst_ip="163.205.130.174" src_port="443"/>
        </slice>
        <from usec="0" sec="1551589222"/>
        <to usec="0" sec="1551589817"/>
    </anomaly>
    <anomaly type="anomalous" value="5.02462,4.70083,010,0 0 0 0 0 0 1 1 0 0 0 0,poscaSYN">
        <slice>
            <filter src_ip="178.62.233.109" dst_ip="163.205.172.209" src_port="49287"/>
        </slice>
        <from usec="0" sec="1551589200"/>
        <to usec="0" sec="1551589966"/>
    </anomaly>
    <anomaly type="anomalous" value="1.27998,1.24501,504,1 1 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.205.131.21" src_port="443"/>
            <filter dst_ip="163.205.154.221" src_port="443"/>
            <filter dst_ip="163.205.131.87" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.38358,1.82417,504,1 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.139.219.251" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.23688,1.78785,504,0 0 0 1 1 1 0 0 0 0 1 0,mptp">
        <slice>
            <filter dst_ip="163.205.131.21" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.48732,1.9275,999,1 1 1 1 1 1 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="203.243.105.55" dst_ip="206.51.220.129"/>
            <filter src_ip="203.243.105.55" dst_ip="204.250.46.29"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.81457,1.52794,504,1 1 0 1 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.58.166.195" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.51663,1.396,503,1 1 1 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.243.100.171" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.38242,1.83896,999,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.243.98.211"/>
            <filter dst_ip="203.243.98.226" dst_port="3010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.38358,1.82417,504,1 0 0 1 1 1 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="152.191.78.203" dst_ip="203.243.105.177" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
