<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="anomalous" value="1.22627,1.17631,504,1 0 0 0 0 0 1 1 1 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.25.92.254" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47592,1.22988,504,1 0 0 1 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="202.251.36.9" dst_port="443"/>
            <filter dst_ip="162.134.194.145" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.32984,1.88062,010,1 1 1 1 1 1 1 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="110.174.72.18" src_port="19611" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.43446,1.92925,999,1 1 1 1 1 1 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.178.118.245" dst_ip="206.195.35.1"/>
            <filter src_ip="203.178.118.245" dst_ip="204.253.226.22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.41026,1.31837,010,1 1 1 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="13.19.64.178" dst_port="3306"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.89642,1.63824,999,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="126.106.213.91" dst_ip="203.178.121.26" src_port="60569" dst_port="43233"/>
            <filter src_ip="126.106.213.91" dst_ip="203.178.121.26" src_port="60568" dst_port="3010"/>
            <filter src_ip="126.106.213.91" dst_ip="203.178.121.26" src_port="60566" dst_port="37268"/>
            <filter src_ip="126.106.213.91" dst_ip="203.178.121.26" src_port="60565" dst_port="3010"/>
        </slice>
        <from usec="0" sec="1554354340"/>
        <to usec="0" sec="1554354366"/>
    </anomaly>
    <anomaly type="anomalous" value="1.19005,1.09278,011,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="204.253.226.22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.30526,1.19639,503,0 0 0 1 0 0 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.178.118.80" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.9895,1.67557,999,1 1 1 1 1 0 1 1 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.127.52" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22522,1.22321,999,1 0 0 1 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="104.16.135.60" dst_ip="202.251.33.16" dst_port="123"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354721"/>
    </anomaly>
    <anomaly type="anomalous" value="1.37139,1.27985,504,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.251.39.51" src_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354108"/>
    </anomaly>
    <anomaly type="anomalous" value="1.30526,1.19639,011,0 0 0 1 0 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter dst_ip="92.3.251.20" dst_port="53819"/>
            <filter dst_ip="183.190.104.133"/>
            <filter dst_ip="183.190.104.133"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.25518,1.20603,504,1 0 0 1 0 0 1 1 1 1 0 0,ptmp">
        <slice>
            <filter src_ip="202.246.143.150" dst_port="443"/>
            <filter src_ip="202.246.143.150" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36276,1.225,504,0 0 0 0 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.50.11.214" src_port="443"/>
            <filter dst_ip="163.50.125.190" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.93023,1.52374,504,1 0 0 1 1 0 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.25.92.254" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36276,1.225,504,0 0 0 0 0 0 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.50.57.22" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36276,1.225,504,0 0 0 0 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.251.39.89" src_port="443"/>
            <filter dst_ip="163.50.158.169" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.13926,1.7025,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="81.218.173.238" src_port="80"/>
            <filter dst_ip="202.251.39.67" src_port="80"/>
            <filter dst_ip="202.251.39.67" src_port="443"/>
            <filter dst_ip="163.50.13.34" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.91401,1.6422,504,0 0 0 1 1 1 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="104.208.224.171" dst_ip="163.50.11.132" src_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354738"/>
    </anomaly>
    <anomaly type="anomalous" value="1.1425,1.13218,504,1 1 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="31.145.27.111" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.15487,1.70631,999,0 0 0 1 1 1 1 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="204.253.226.22" dst_port="161"/>
            <filter src_ip="204.253.226.22" dst_port="445"/>
            <filter src_ip="204.253.226.22" dst_port="179"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.15487,1.70631,999,0 0 0 1 1 1 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.178.121.17" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.13926,1.7025,999,0 0 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.178.121.7" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.74165,1.44163,010,1 1 1 1 0 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="58.218.45.174" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36775,1.21659,503,1 1 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="82.53.5.212" src_port="80"/>
            <filter src_ip="17.6.182.20" src_port="80"/>
            <filter src_ip="17.6.182.20" src_port="443"/>
            <filter dst_ip="163.50.157.116" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.15487,1.70631,504,0 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.13926,1.7025,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="17.2.25.9" dst_ip="163.50.172.39"/>
            <filter src_ip="17.2.25.9" dst_ip="163.50.172.56"/>
            <filter src_ip="17.2.25.9" src_port="443"/>
            <filter dst_ip="163.50.172.39" src_port="443"/>
            <filter dst_ip="163.50.172.56" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.13926,1.7025,999,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.178.121.7" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.06831,1.63987,010,1 1 1 1 1 0 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="204.253.226.22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.69137,1.36113,503,0 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.178.124.23" dst_ip="218.181.8.230"/>
            <filter src_ip="203.178.124.23" src_port="80"/>
            <filter dst_ip="218.181.8.230" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36276,1.225,504,0 0 0 0 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.50.17.166" src_port="443"/>
            <filter dst_ip="163.50.125.80" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.25518,1.20603,504,1 0 0 1 0 0 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="202.246.176.61" src_port="53"/>
            <filter dst_ip="202.246.176.61" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.3327,1.8351,504,1 0 0 1 1 1 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.251.36.9" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.09734,1.05492,020,0 0 0 0 0 0 0 0 0 1 1 1,icmp_error">
        <slice>
            <filter src_ip="131.126.16.174"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.18826,1.72622,504,1 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.178.99.236" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.02505,1.02155,010,0 0 0 1 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="221.209.130.85" src_port="54608" dst_port="23"/>
            <filter src_ip="221.209.130.85" src_port="54608" dst_port="2323"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.09734,1.05492,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="187.240.60.34" dst_ip="203.178.121.43" src_port="54829" dst_port="43367"/>
            <filter src_ip="187.240.60.34" dst_ip="203.178.121.43" src_port="51822" dst_port="3010"/>
            <filter src_ip="187.240.60.34" dst_ip="203.178.121.43" src_port="51818" dst_port="3010"/>
            <filter src_ip="187.240.60.34" dst_ip="203.178.121.43" src_port="14278" dst_port="32997"/>
            <filter src_ip="187.240.60.34" dst_ip="203.178.121.41"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.09734,1.05492,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="74.142.231.41" dst_ip="202.251.36.160" src_port="80" dst_port="56316"/>
            <filter src_ip="74.142.231.41" dst_ip="202.251.36.160" src_port="80" dst_port="54525"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.09734,1.05492,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="203.178.121.26" src_port="3010"/>
            <filter src_ip="203.178.121.26" dst_port="35044"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.27129,1.11438,504,0 0 0 1 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="172.222.152.97" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.21788,1.09871,504,1 0 0 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.178.99.236" src_port="443"/>
            <filter dst_ip="163.50.4.233" src_port="443"/>
            <filter dst_ip="163.50.156.96" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.27129,1.11438,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.178.99.236" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.13926,1.7025,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.246.143.150" src_port="443"/>
            <filter dst_ip="202.246.143.150" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.27129,1.11438,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.50.159.83" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.71107,1.3659,504,0 0 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.50.79.18" src_port="443"/>
            <filter dst_ip="203.178.116.24" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.09734,1.05492,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="23.162.3.250" dst_ip="163.50.17.124" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36276,1.225,504,0 0 0 0 0 0 1 1 1 1 1 1,alphfl">
        <slice>
            <filter src_ip="172.222.155.40" dst_ip="202.251.36.221" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.43846,1.25776,011,1 0 0 0 0 0 1 1 1 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="162.134.156.12" dst_ip="203.178.124.23" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.09734,1.05492,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.178.121.17" src_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.09734,1.05492,011,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="203.178.121.19" dst_port="35039"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.09734,1.05492,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="104.160.238.154" dst_ip="163.50.124.126" src_port="443" dst_port="63105"/>
            <filter src_ip="104.160.238.154" dst_ip="163.50.124.126" src_port="443" dst_port="63104"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.09734,1.05492,999,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="195.227.138.193" dst_ip="203.178.121.43" src_port="56518" dst_port="39930"/>
            <filter src_ip="195.227.138.193" dst_ip="203.178.121.43" src_port="43238" dst_port="42566"/>
            <filter src_ip="195.227.138.193" dst_ip="203.178.121.43" src_port="35614" dst_port="3010"/>
            <filter src_ip="195.227.138.193" dst_ip="203.178.121.43" src_port="35610" dst_port="3010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.09734,1.05492,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="131.255.91.47" dst_ip="163.50.192.255" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.24669,1.14119,504,0 0 0 0 0 0 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.246.143.150" src_port="443"/>
            <filter dst_ip="202.246.143.150" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.09734,1.05492,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="117.131.205.33" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.12746,1.06106,504,0 0 0 0 0 0 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="162.134.156.12" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.09734,1.05492,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="52.55.139.244" dst_ip="202.251.39.69" src_port="443" dst_port="52203"/>
            <filter src_ip="52.55.139.244" dst_ip="202.251.39.69" src_port="443" dst_port="52202"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.09734,1.05492,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.50.159.202" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00081,1.08524,503,1 0 0 0 0 0 0 0 0 0 0 1,mptmp">
        <slice>
            <filter src_ip="101.23.83.10" dst_ip="133.216.136.173" dst_port="80"/>
            <filter src_ip="203.178.121.19" dst_ip="99.252.223.108" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,010,1 0 0 0 0 0 0 0 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="138.198.142.241" dst_ip="163.50.149.138" src_port="23812" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1554354666"/>
        <to usec="0" sec="1554354672"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="49.30.210.206" dst_ip="202.251.33.30" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1554354668"/>
        <to usec="0" sec="1554354670"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,010,1 0 0 0 0 0 0 0 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="68.135.159.162" dst_ip="163.50.40.113" src_port="40916" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1554354666"/>
        <to usec="0" sec="1554354672"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.204.72.67" dst_ip="34.32.221.144" src_port="61586" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1554354434"/>
        <to usec="0" sec="1554354435"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="203.178.122.38" dst_ip="184.227.234.150" src_port="30965" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1554354306"/>
        <to usec="0" sec="1554354672"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.50.195.77" dst_ip="23.232.245.47" src_port="52296" dst_port="443"/>
        </slice>
        <from usec="0" sec="1554354667"/>
        <to usec="0" sec="1554354669"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,504,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="52.201.224.201"/>
        </slice>
        <from usec="0" sec="1554354666"/>
        <to usec="0" sec="1554354670"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,999,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.50.243.108"/>
        </slice>
        <from usec="0" sec="1554354667"/>
        <to usec="0" sec="1554354668"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="202.246.176.10" dst_ip="202.246.176.10" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1554354236"/>
        <to usec="0" sec="1554354815"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="111.82.2.198"/>
        </slice>
        <from usec="0" sec="1554354880"/>
        <to usec="0" sec="1554354883"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,010,1 0 0 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.186.12.82" dst_port="445" proto="tcp"/>
        </slice>
        <from usec="0" sec="1554354477"/>
        <to usec="0" sec="1554354478"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,010,1 0 0 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.186.12.79"/>
        </slice>
        <from usec="0" sec="1554354431"/>
        <to usec="0" sec="1554354432"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="119.197.115.54"/>
        </slice>
        <from usec="0" sec="1554354863"/>
        <to usec="0" sec="1554354865"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,011,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="220.139.238.95"/>
        </slice>
        <from usec="0" sec="1554354324"/>
        <to usec="0" sec="1554354326"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="163.50.159.83"/>
        </slice>
        <from usec="0" sec="1554354269"/>
        <to usec="0" sec="1554354270"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,010,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="68.135.156.209"/>
        </slice>
        <from usec="0" sec="1554354463"/>
        <to usec="0" sec="1554354464"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28112,1.31706,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="77.245.19.2" src_port="5174" dst_port="6050"/>
        </slice>
        <from usec="0" sec="1554354071"/>
        <to usec="0" sec="1554354445"/>
    </anomaly>
    <anomaly type="suspicious" value="0.823801,1.08817,010,0 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="198.136.139.212" src_port="21" dst_port="21"/>
        </slice>
        <from usec="0" sec="1554354170"/>
        <to usec="0" sec="1554354175"/>
    </anomaly>
    <anomaly type="suspicious" value="0.943776,1.12491,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="151.102.59.205" dst_port="89"/>
        </slice>
        <from usec="0" sec="1554354726"/>
        <to usec="0" sec="1554354823"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="42.33.88.218"/>
        </slice>
        <from usec="0" sec="1554354015"/>
        <to usec="0" sec="1554354838"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="37.179.134.66"/>
        </slice>
        <from usec="0" sec="1554354460"/>
        <to usec="0" sec="1554354570"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="77.245.19.16" src_port="5097" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1554354476"/>
        <to usec="0" sec="1554354478"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="77.245.19.33" src_port="5108" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1554354534"/>
        <to usec="0" sec="1554354535"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="77.245.18.246" src_port="5081" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1554354503"/>
        <to usec="0" sec="1554354505"/>
    </anomaly>
    <anomaly type="suspicious" value="1.14138,1.18085,999,1 1 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.178.127.52" src_port="123"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354468"/>
    </anomaly>
    <anomaly type="suspicious" value="0.943776,1.12491,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="118.91.131.184" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1554354545"/>
        <to usec="0" sec="1554354546"/>
    </anomaly>
    <anomaly type="suspicious" value="0.943776,1.12491,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="27.129.236.3" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1554354884"/>
        <to usec="0" sec="1554354885"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="163.80.193.46" dst_port="22"/>
        </slice>
        <from usec="0" sec="1554354170"/>
        <to usec="0" sec="1554354175"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="192.106.153.17"/>
        </slice>
        <from usec="0" sec="1554354416"/>
        <to usec="0" sec="1554354417"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="163.80.192.182" dst_port="22"/>
        </slice>
        <from usec="0" sec="1554354615"/>
        <to usec="0" sec="1554354619"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.176.124.248" dst_port="23"/>
        </slice>
        <from usec="0" sec="1554354413"/>
        <to usec="0" sec="1554354464"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="117.214.0.139" dst_port="65533"/>
        </slice>
        <from usec="0" sec="1554354065"/>
        <to usec="0" sec="1554354107"/>
    </anomaly>
    <anomaly type="suspicious" value="0.943776,1.12491,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="180.2.30.166" dst_port="65533"/>
        </slice>
        <from usec="0" sec="1554354114"/>
        <to usec="0" sec="1554354116"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="220.139.238.74" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1554354324"/>
        <to usec="0" sec="1554354326"/>
    </anomaly>
    <anomaly type="suspicious" value="0.943776,1.12491,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="125.160.238.201" dst_port="3312"/>
        </slice>
        <from usec="0" sec="1554354758"/>
        <to usec="0" sec="1554354760"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="210.218.177.197" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1554354799"/>
        <to usec="0" sec="1554354800"/>
    </anomaly>
    <anomaly type="suspicious" value="0.943776,1.12491,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.26.203.255" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1554354170"/>
        <to usec="0" sec="1554354176"/>
    </anomaly>
    <anomaly type="suspicious" value="0.943776,1.12491,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="58.27.162.63" dst_port="445"/>
        </slice>
        <from usec="0" sec="1554354090"/>
        <to usec="0" sec="1554354092"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="152.221.59.211"/>
        </slice>
        <from usec="0" sec="1554354361"/>
        <to usec="0" sec="1554354534"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="128.97.75.146"/>
        </slice>
        <from usec="0" sec="1554354611"/>
        <to usec="0" sec="1554354695"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="120.180.100.22"/>
        </slice>
        <from usec="0" sec="1554354219"/>
        <to usec="0" sec="1554354220"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="159.43.58.152"/>
        </slice>
        <from usec="0" sec="1554354531"/>
        <to usec="0" sec="1554354840"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="155.176.208.153"/>
        </slice>
        <from usec="0" sec="1554354088"/>
        <to usec="0" sec="1554354772"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="172.222.153.200"/>
        </slice>
        <from usec="0" sec="1554354144"/>
        <to usec="0" sec="1554354393"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="203.178.99.236"/>
        </slice>
        <from usec="0" sec="1554354863"/>
        <to usec="0" sec="1554354864"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.216.159.252"/>
        </slice>
        <from usec="0" sec="1554354298"/>
        <to usec="0" sec="1554354769"/>
    </anomaly>
    <anomaly type="suspicious" value="0.943776,1.12491,502,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="139.215.255.68" src_port="22" dst_port="624"/>
        </slice>
        <from usec="0" sec="1554354671"/>
        <to usec="0" sec="1554354672"/>
    </anomaly>
    <anomaly type="suspicious" value="0.943776,1.12491,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="115.176.205.126" dst_port="445"/>
        </slice>
        <from usec="0" sec="1554354268"/>
        <to usec="0" sec="1554354271"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="220.139.238.93" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1554354345"/>
        <to usec="0" sec="1554354347"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28112,1.31706,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="139.215.255.68" src_port="624" dst_port="22"/>
        </slice>
        <from usec="0" sec="1554354630"/>
        <to usec="0" sec="1554354676"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28396,1.29612,010,1 1 1 0 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="202.109.174.121" src_port="45370" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28112,1.31706,020,1 1 1 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="118.254.98.175"/>
        </slice>
        <from usec="0" sec="1554354855"/>
        <to usec="0" sec="1554354901"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="210.131.236.183" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1554354605"/>
        <to usec="0" sec="1554354606"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="104.93.168.15"/>
        </slice>
        <from usec="0" sec="1554354058"/>
        <to usec="0" sec="1554354195"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="106.253.53.245" dst_port="445"/>
            <filter src_ip="106.253.53.245" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1554354894"/>
        <to usec="0" sec="1554354897"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="107.97.43.223"/>
        </slice>
        <from usec="0" sec="1554354863"/>
        <to usec="0" sec="1554354864"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25469,1.31212,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.186.23.165" dst_port="445"/>
        </slice>
        <from usec="0" sec="1554354367"/>
        <to usec="0" sec="1554354370"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,010,0 0 0 1 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="185.211.213.226"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354108"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,010,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="92.9.20.242" src_port="52376"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354108"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,012,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="202.4.235.79"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354108"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="159.214.76.28" src_port="9369" dst_port="23"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354108"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="139.156.159.70"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354108"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="164.71.132.115"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354108"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="64.115.251.190" src_port="15009" dst_port="23"/>
        </slice>
        <from usec="0" sec="1554354002"/>
        <to usec="0" sec="1554354466"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="64.115.251.237"/>
        </slice>
        <from usec="0" sec="1554354005"/>
        <to usec="0" sec="1554354108"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354648"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354828"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,504,0 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.50.11.118"/>
        </slice>
        <from usec="0" sec="1554354006"/>
        <to usec="0" sec="1554354278"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,999,0 0 0 1 0 0 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter dst_ip="213.27.12.238"/>
        </slice>
        <from usec="0" sec="1554354033"/>
        <to usec="0" sec="1554354468"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,010,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="142.57.178.110"/>
        </slice>
        <from usec="0" sec="1554354064"/>
        <to usec="0" sec="1554354270"/>
    </anomaly>
    <anomaly type="suspicious" value="1.23763,1.25089,010,1 0 1 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="202.25.91.243" dst_port="445"/>
            <filter src_ip="198.136.139.212" src_port="21" dst_port="21"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354350"/>
    </anomaly>
    <anomaly type="suspicious" value="0.714483,0.968372,011,1 0 0 0 0 0 0 0 0 1 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="183.190.104.133" src_port="1962"/>
            <filter dst_ip="183.190.104.133" src_port="3128"/>
            <filter dst_ip="183.190.104.133" src_port="1723"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,999,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="136.66.91.153"/>
        </slice>
        <from usec="0" sec="1554354202"/>
        <to usec="0" sec="1554354281"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,999,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.109.246.25"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354468"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,010,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="134.46.158.0"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354558"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="203.178.99.236"/>
        </slice>
        <from usec="0" sec="1554354001"/>
        <to usec="0" sec="1554354558"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,502,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.204.123.214"/>
        </slice>
        <from usec="0" sec="1554354012"/>
        <to usec="0" sec="1554354557"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="122.24.106.149"/>
        </slice>
        <from usec="0" sec="1554354734"/>
        <to usec="0" sec="1554354828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21189,1.22843,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21189,1.22843,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354648"/>
    </anomaly>
    <anomaly type="suspicious" value="1.39277,1.39427,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354378"/>
    </anomaly>
    <anomaly type="suspicious" value="1.39277,1.39427,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354378"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16765,1.17183,999,0 0 0 1 0 0 1 1 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.50.124.226" src_port="53"/>
            <filter dst_ip="163.50.124.226" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16765,1.17183,999,0 0 0 1 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="133.204.219.210" dst_ip="185.184.93.44" src_port="5900"/>
            <filter src_ip="133.204.219.211" dst_ip="185.184.93.44" src_port="5900"/>
            <filter dst_ip="77.245.19.2"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,010,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="204.253.226.22" dst_ip="203.178.17.157" src_port="35649"/>
            <filter src_ip="183.190.104.133" dst_ip="203.178.17.157" src_port="35649"/>
        </slice>
        <from usec="0" sec="1554354002"/>
        <to usec="0" sec="1554354737"/>
    </anomaly>
    <anomaly type="suspicious" value="0.975389,1.11544,010,0 0 0 0 0 0 1 1 1 1 0 0,poscaSYN">
        <slice>
            <filter src_ip="178.237.85.9" dst_ip="163.50.226.88" src_port="53341"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0159,1.11205,010,1 1 0 0 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="193.188.110.132"/>
            <filter src_ip="193.188.110.151"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.975389,1.11544,504,0 0 0 0 0 0 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.50.125.244" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="203.178.116.24" dst_ip="13.236.132.181" dst_port="80"/>
        </slice>
        <from usec="0" sec="1554354648"/>
        <to usec="0" sec="1554354671"/>
    </anomaly>
    <anomaly type="suspicious" value="0.975389,1.11544,999,0 0 0 0 0 0 1 1 1 1 0 0,ptmp">
        <slice>
            <filter src_ip="203.178.119.68" src_port="53"/>
            <filter src_ip="203.178.119.68" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.797583,1.01349,504,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="17.0.98.245" dst_ip="163.50.159.30" src_port="443"/>
            <filter src_ip="17.0.98.245" dst_ip="202.246.176.61" src_port="443"/>
        </slice>
        <from usec="0" sec="1554354382"/>
        <to usec="0" sec="1554354725"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.216.177.171" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.251.49.37" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.13652,1.14122,010,0 0 0 0 0 0 1 1 1 1 1 0,mptp">
        <slice>
            <filter dst_ip="133.216.178.43" dst_port="50356"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709368,0.996235,502,1 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="58.252.158.217" src_port="22"/>
        </slice>
        <from usec="0" sec="1554354675"/>
        <to usec="0" sec="1554354815"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.251.114.164" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.978641,1.13067,504,1 1 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.251.36.210" dst_port="443"/>
        </slice>
        <from usec="0" sec="1554354193"/>
        <to usec="0" sec="1554354721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.759941,0.975055,504,1 0 0 0 0 0 1 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="206.6.250.97" dst_ip="203.178.124.25" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.251.49.52" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.757765,1.0429,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="148.169.20.173" dst_ip="203.178.118.245" dst_port="53"/>
        </slice>
        <from usec="0" sec="1554354540"/>
        <to usec="0" sec="1554354721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709368,0.996235,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="125.160.238.194" dst_port="10332"/>
        </slice>
        <from usec="0" sec="1554354855"/>
        <to usec="0" sec="1554354901"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,DDoSUDP">
        <slice>
            <filter dst_ip="38.66.58.15" dst_port="53"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.50.158.37" src_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.119.65" dst_port="53"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.975389,1.11544,999,0 0 0 0 0 0 1 1 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.50.196.252" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.50.196.253" src_port="53"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.50.196.254" src_port="53"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.50.196.216" src_port="53"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.50.196.217" src_port="53"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.975389,1.11544,999,0 0 0 0 0 0 1 1 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.50.196.218" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.50.196.219" src_port="53"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.13652,1.14122,504,0 0 0 0 0 0 1 1 1 1 1 0,heavy_hitter">
        <slice>
            <filter src_ip="163.50.15.164" dst_ip="65.184.133.44" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.50.125.81" src_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,504,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="210.77.168.177" dst_ip="163.50.20.106" src_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,504,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.204.200.168" dst_ip="52.44.163.96" dst_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.50.81.250" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.50.20.122" src_port="443"/>
            <filter dst_ip="163.50.20.122" src_port="80"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16765,1.17183,504,0 0 0 1 0 0 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="162.134.194.121" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.178.127.141" dst_port="53"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.712168,1.03665,999,0 0 0 0 0 0 0 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.50.243.119"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="64.134.4.97" dst_ip="203.178.122.85" src_port="53"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="64.134.4.97" dst_ip="203.178.122.84" src_port="53"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.50.74.19" src_port="443"/>
            <filter dst_ip="163.50.74.19" src_port="80"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.251.48.51" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.757765,1.0429,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="104.109.234.112" dst_ip="202.251.33.16" dst_port="123"/>
            <filter src_ip="104.109.234.102" dst_ip="202.251.33.16" dst_port="123"/>
        </slice>
        <from usec="0" sec="1554354270"/>
        <to usec="0" sec="1554354586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="172.222.154.238" dst_ip="163.50.124.226" dst_port="23"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.50.174.140" src_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.50.157.5" src_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.119.92" dst_port="53"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.216.177.203" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.50.171.71" src_port="7273"/>
            <filter dst_ip="163.50.171.71" dst_port="31576"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,011,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="107.106.26.67" src_port="5631"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.50.16.86" src_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.50.79.63" src_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.50.196.250" src_port="53"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.725936,1.04714,999,0 0 0 0 0 0 0 0 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.50.197.29"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,011,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="195.24.139.195" src_port="52869"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04362,1.16931,504,1 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="39.237.48.62" dst_ip="202.246.162.111" dst_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354669"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="64.134.4.97" dst_ip="203.178.122.80" src_port="53"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.216.178.77" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354721"/>
    </anomaly>
    <anomaly type="suspicious" value="1.13539,1.18951,020,0 0 0 1 0 0 1 1 1 0 0 0,DDoSIC">
        <slice>
            <filter dst_ip="203.178.106.167" dst_port="53"/>
            <filter dst_ip="203.178.106.167"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.178.118.245" dst_port="53"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.50.9.220" src_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,504,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="202.25.92.254" dst_ip="52.26.236.199" dst_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.251.48.42" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354721"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.178.122.36" src_port="443"/>
            <filter src_ip="1.254.253.99" dst_ip="203.178.122.36" src_port="53"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900029,1.12826,504,0 0 0 0 0 0 0 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.50.124.236" src_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.975389,1.11544,504,0 0 0 0 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter dst_ip="202.246.176.10" src_port="443"/>
            <filter dst_ip="163.50.174.142" src_port="443"/>
            <filter src_ip="208.195.238.254" dst_ip="202.246.176.10" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.982355,1.1062,999,1 1 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="193.188.110.134"/>
            <filter dst_ip="193.188.110.132"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.922371,0.997955,504,1 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.50.74.20" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.936524,1.134,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.50.124.188" src_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900029,1.12826,504,0 0 0 0 0 0 0 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.50.31.174" src_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.975389,1.11544,999,0 0 0 0 0 0 1 1 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.119.68" dst_port="53"/>
            <filter src_ip="192.191.77.71" dst_ip="203.178.119.68" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.975389,1.11544,504,0 0 0 0 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="192.157.34.158" src_port="53"/>
            <filter dst_ip="202.246.143.150" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="193.188.110.134"/>
        </slice>
        <from usec="0" sec="1554354147"/>
        <to usec="0" sec="1554354830"/>
    </anomaly>
    <anomaly type="suspicious" value="0.714483,0.968372,504,1 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="163.50.188.50" dst_ip="14.186.18.123" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.799188,0.956346,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.251.33.30" src_port="443"/>
            <filter src_ip="202.251.33.30" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.799188,0.956346,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="143.40.145.103" dst_ip="163.50.157.124" src_port="80" dst_port="56676"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.799188,0.956346,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="14.186.18.123" dst_ip="163.50.188.50" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.799188,0.956346,010,0 0 0 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="185.248.234.86" dst_port="81"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.799188,0.956346,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="192.14.118.160" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.799188,0.956346,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.251.36.210" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.799188,0.956346,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.178.34.158" src_port="443"/>
            <filter dst_ip="203.178.34.158" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.799188,0.956346,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_port="3478" dst_port="61475"/>
            <filter src_port="3478" dst_port="55532"/>
            <filter src_port="19350" dst_port="61475"/>
            <filter src_port="19350" dst_port="55532"/>
            <filter src_ip="54.193.142.28" dst_ip="163.50.125.123" src_port="3478"/>
            <filter src_ip="54.193.142.28" dst_ip="163.50.125.123" src_port="443"/>
            <filter src_ip="54.193.142.28" dst_ip="163.50.125.123" src_port="19350"/>
            <filter src_ip="54.193.142.28" dst_ip="163.50.125.123" dst_port="61475"/>
            <filter src_ip="54.193.142.28" dst_ip="163.50.125.123" dst_port="55532"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.799188,0.956346,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="54.58.32.122" dst_ip="163.50.74.20" src_port="443" dst_port="57027"/>
            <filter src_ip="54.58.32.122" dst_ip="163.50.74.20" src_port="443" dst_port="57026"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.799188,0.956346,504,0 0 0 0 0 0 0 0 0 1 1 0,heavy_hitter">
        <slice>
            <filter src_ip="66.229.134.222" dst_ip="202.251.33.30" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.799188,0.956346,501,0 0 0 0 0 0 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="203.178.118.80" dst_ip="126.30.100.137" src_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.799188,0.956346,999,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="46.154.99.57" dst_ip="133.216.177.177"/>
            <filter src_ip="46.154.99.57" dst_port="2323"/>
            <filter dst_ip="133.216.177.177" dst_port="2323"/>
            <filter dst_ip="133.216.177.177" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.799188,0.956346,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.50.124.134" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900029,1.12826,504,0 0 0 0 0 0 0 1 1 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="104.208.214.223" dst_ip="202.251.36.160" src_port="80"/>
            <filter src_ip="183.76.10.3" dst_ip="202.251.36.160" src_port="443"/>
        </slice>
        <from usec="0" sec="1554354000"/>
        <to usec="0" sec="1554354046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.660438,0.989695,503,1 0 0 0 0 0 0 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="218.181.8.230" dst_ip="203.178.118.80" dst_port="80"/>
        </slice>
        <from usec="0" sec="1554354666"/>
        <to usec="0" sec="1554354670"/>
    </anomaly>
    <anomaly type="suspicious" value="0.799188,0.956346,999,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="133.216.177.161" dst_ip="46.154.99.57"/>
            <filter src_ip="133.216.177.161" src_port="23"/>
            <filter src_ip="133.216.177.182" dst_ip="46.154.99.57"/>
            <filter src_ip="133.216.177.182" src_port="23"/>
            <filter dst_ip="46.154.99.57" src_port="23"/>
            <filter dst_ip="46.154.99.57" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.799188,0.956346,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="163.50.157.226" dst_ip="52.191.164.89" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.799188,0.956346,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_port="61475" dst_port="3478"/>
            <filter src_port="61475" dst_port="19350"/>
            <filter src_port="55532" dst_port="3478"/>
            <filter src_port="55532" dst_port="19350"/>
            <filter src_ip="163.50.125.123" dst_ip="54.193.142.28" src_port="61475"/>
            <filter src_ip="163.50.125.123" dst_ip="54.193.142.28" src_port="55532"/>
            <filter src_ip="163.50.125.123" dst_ip="54.193.142.28" dst_port="3478"/>
            <filter src_ip="163.50.125.123" dst_ip="54.193.142.28" dst_port="443"/>
            <filter src_ip="163.50.125.123" dst_ip="54.193.142.28" dst_port="19350"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.964828,1.03328,504,0 0 0 0 0 0 1 0 0 1 0 1,mptp">
        <slice>
            <filter dst_ip="163.50.11.214" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
