<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="anomalous" value="1.69722,1.31146,999,1 1 1 1 1 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.46.150.207" dst_ip="206.83.99.1"/>
            <filter src_ip="203.46.150.207" dst_ip="204.220.201.227"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.97992,1.48033,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="208.93.36.21" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.32249,1.6758,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="202.114.206.145" src_port="6000" dst_port="8081"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.73856,1.36435,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="8.236.106.162" src_port="443"/>
            <filter dst_ip="8.236.106.162" dst_port="62104"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.73856,1.36435,999,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.46.157.100"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.44316,1.33963,999,0 0 0 1 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="210.188.160.67" dst_ip="163.45.91.235" dst_port="53"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032507"/>
    </anomaly>
    <anomaly type="anomalous" value="2.32249,1.6758,010,1 1 1 1 1 1 1 1 1 1 1 1,ptmp">
        <slice>
            <filter src_ip="185.173.217.213" src_port="46960"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.95592,1.55367,999,1 1 1 1 1 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.46.153.79" dst_port="123"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557033224"/>
    </anomaly>
    <anomaly type="anomalous" value="1.2962,1.28856,999,0 0 0 0 0 0 1 1 1 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.46.151.223" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.12049,1.57428,011,0 0 0 1 1 1 1 1 1 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="185.173.216.5" dst_port="41672"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.44316,1.33963,504,0 0 0 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.45.157.79" src_port="443"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032688"/>
    </anomaly>
    <anomaly type="anomalous" value="1.87323,1.4309,503,1 1 1 1 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.46.150.16" dst_port="80"/>
            <filter dst_ip="203.46.155.93" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.77178,1.37015,504,1 1 0 1 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="202.22.72.30" dst_port="443"/>
            <filter src_ip="202.139.192.196" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.2962,1.28856,999,0 0 0 0 0 0 1 1 1 1 0 0,ptmpla">
        <slice>
            <filter src_ip="64.249.191.57" dst_ip="203.46.158.96" src_port="53"/>
            <filter src_ip="64.249.191.57" dst_ip="203.46.158.101" src_port="53"/>
            <filter src_ip="64.249.191.57" dst_ip="203.46.158.100" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.15313,1.10649,020,1 0 0 0 0 0 1 0 0 1 1 1,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="77.200.146.24"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.73856,1.36435,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.45.127.252" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.73856,1.36435,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.45.236.229" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.29195,1.16974,999,1 1 1 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.46.157.84" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.13441,1.11142,502,1 1 0 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="58.238.71.20" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.2962,1.28856,010,0 0 0 0 0 0 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="133.5.13.197" dst_port="50356"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.97992,1.48033,999,1 1 1 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.46.157.84" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.73856,1.36435,504,0 0 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="185.227.61.38" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.73856,1.36435,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.45.199.61" src_port="443"/>
            <filter dst_ip="163.45.199.61" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.66531,1.34722,010,1 1 0 0 0 0 1 1 1 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="125.67.175.79" dst_port="50200"/>
            <filter src_ip="125.67.175.79" dst_port="36"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.12049,1.57428,010,0 0 0 1 1 1 1 1 1 1 1 1,ptmp">
        <slice>
            <filter src_ip="81.22.45.25" src_port="59707"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36643,1.27675,502,0 0 0 0 0 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter src_ip="133.24.114.20" dst_ip="58.238.70.242"/>
            <filter src_ip="133.24.114.20" src_port="22"/>
            <filter src_ip="133.24.114.31" dst_ip="58.238.70.242"/>
            <filter src_ip="133.24.114.31" src_port="22"/>
            <filter dst_ip="122.162.245.154" src_port="22"/>
            <filter dst_ip="58.238.70.242" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.73856,1.36435,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.45.159.89" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.79055,1.35623,010,1 1 1 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="185.173.217.221" src_port="55776"/>
            <filter src_ip="178.222.237.218" dst_port="53413"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.12049,1.57428,504,0 0 0 1 1 1 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.22.72.30" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.49852,1.28657,011,0 0 0 0 0 0 1 1 1 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="185.173.217.213" dst_port="46960"/>
            <filter dst_ip="185.149.59.189" dst_port="59801"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.49852,1.28657,020,0 0 0 0 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="185.236.204.249" src_port="49180"/>
            <filter dst_ip="35.75.167.168"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.73856,1.36435,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.97992,1.48033,999,1 1 1 1 1 1 0 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="185.203.217.244" src_port="58439" dst_port="389"/>
            <filter src_ip="185.203.217.244" src_port="53470" dst_port="19"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.0666,1.04912,504,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.45.198.57" src_port="443"/>
            <filter dst_ip="163.45.119.29" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.61602,1.31056,504,0 0 0 1 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.45.176.63" src_port="443"/>
            <filter dst_ip="163.45.228.26" src_port="443"/>
            <filter dst_ip="85.251.5.176" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.88423,1.42169,504,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.45.151.204" src_port="443"/>
            <filter dst_ip="163.45.248.188" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.73856,1.36435,011,0 0 0 1 1 1 0 0 0 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="185.149.59.232" dst_port="46121"/>
            <filter dst_ip="81.22.45.144" dst_port="41482"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.73856,1.36435,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.133.224.14" src_port="443"/>
            <filter dst_ip="163.45.182.87" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.97992,1.48033,010,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="139.59.89.182" src_port="50775" dst_port="23022"/>
            <filter src_ip="185.186.84.81" src_port="56214" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.69722,1.31146,503,1 1 1 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.46.150.16" src_port="80"/>
            <filter src_ip="203.46.155.93" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21074,1.2509,011,1 1 1 0 0 0 1 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="202.114.206.145" src_port="8081" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1557032915"/>
        <to usec="0" sec="1557033191"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.46.153.79" src_port="123"/>
        </slice>
        <from usec="0" sec="1557032577"/>
        <to usec="0" sec="1557032822"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04696,1.18092,020,1 1 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="185.203.217.244"/>
        </slice>
        <from usec="0" sec="1557032940"/>
        <to usec="0" sec="1557032986"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="62.251.248.182"/>
        </slice>
        <from usec="0" sec="1557033238"/>
        <to usec="0" sec="1557033240"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="128.255.40.162"/>
        </slice>
        <from usec="0" sec="1557033179"/>
        <to usec="0" sec="1557033180"/>
    </anomaly>
    <anomaly type="suspicious" value="0.877826,1.12923,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="45.174.123.68"/>
        </slice>
        <from usec="0" sec="1557032695"/>
        <to usec="0" sec="1557032696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="111.190.34.65"/>
        </slice>
        <from usec="0" sec="1557032515"/>
        <to usec="0" sec="1557032692"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="103.159.195.181" src_port="22" dst_port="22"/>
        </slice>
        <from usec="0" sec="1557032819"/>
        <to usec="0" sec="1557032822"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="119.54.62.7" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1557032449"/>
        <to usec="0" sec="1557032451"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.65.185.23" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1557032614"/>
        <to usec="0" sec="1557032618"/>
    </anomaly>
    <anomaly type="suspicious" value="0.733542,1.09936,010,0 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="111.72.220.31" dst_port="445" proto="tcp"/>
        </slice>
        <from usec="0" sec="1557032892"/>
        <to usec="0" sec="1557032898"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.221.143.9" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1557032615"/>
        <to usec="0" sec="1557032619"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="196.0.199.242" dst_port="139"/>
        </slice>
        <from usec="0" sec="1557032655"/>
        <to usec="0" sec="1557032676"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="119.18.1.163" dst_port="445"/>
        </slice>
        <from usec="0" sec="1557032723"/>
        <to usec="0" sec="1557032725"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="106.84.26.183" dst_port="23"/>
        </slice>
        <from usec="0" sec="1557033139"/>
        <to usec="0" sec="1557033206"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="61.159.222.173" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1557032733"/>
        <to usec="0" sec="1557032737"/>
    </anomaly>
    <anomaly type="suspicious" value="0.877826,1.12923,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="122.92.254.190" dst_port="23"/>
        </slice>
        <from usec="0" sec="1557033275"/>
        <to usec="0" sec="1557033297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="115.159.87.190" dst_port="445"/>
        </slice>
        <from usec="0" sec="1557032833"/>
        <to usec="0" sec="1557032836"/>
    </anomaly>
    <anomaly type="suspicious" value="0.877826,1.12923,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="113.165.169.96" dst_port="445"/>
        </slice>
        <from usec="0" sec="1557032586"/>
        <to usec="0" sec="1557032588"/>
    </anomaly>
    <anomaly type="suspicious" value="0.877826,1.12923,010,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="206.156.198.145" src_port="22054" dst_port="23"/>
        </slice>
        <from usec="0" sec="1557033214"/>
        <to usec="0" sec="1557033276"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="61.161.107.121" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1557033157"/>
        <to usec="0" sec="1557033159"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="101.253.111.219" dst_port="445"/>
        </slice>
        <from usec="0" sec="1557032772"/>
        <to usec="0" sec="1557032773"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="180.161.104.108" dst_port="445"/>
        </slice>
        <from usec="0" sec="1557032624"/>
        <to usec="0" sec="1557032637"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="114.150.75.216" dst_port="445"/>
        </slice>
        <from usec="0" sec="1557032523"/>
        <to usec="0" sec="1557032528"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="122.163.224.94" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1557032674"/>
        <to usec="0" sec="1557032676"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.250.131.57" dst_port="445"/>
        </slice>
        <from usec="0" sec="1557033069"/>
        <to usec="0" sec="1557033071"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.42.158.28" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1557033179"/>
        <to usec="0" sec="1557033180"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.68.60.150" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1557032583"/>
        <to usec="0" sec="1557032587"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="124.168.25.145" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1557033108"/>
        <to usec="0" sec="1557033113"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.43.155.1" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1557032517"/>
        <to usec="0" sec="1557032519"/>
    </anomaly>
    <anomaly type="suspicious" value="0.877826,1.12923,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="37.113.135.119" dst_port="445"/>
        </slice>
        <from usec="0" sec="1557032555"/>
        <to usec="0" sec="1557032567"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="139.161.2.196"/>
        </slice>
        <from usec="0" sec="1557032934"/>
        <to usec="0" sec="1557032935"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="107.162.88.32"/>
        </slice>
        <from usec="0" sec="1557032614"/>
        <to usec="0" sec="1557032615"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.144.160.166"/>
        </slice>
        <from usec="0" sec="1557032540"/>
        <to usec="0" sec="1557033262"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="42.159.168.181"/>
        </slice>
        <from usec="0" sec="1557032598"/>
        <to usec="0" sec="1557033265"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="172.116.78.124"/>
        </slice>
        <from usec="0" sec="1557032758"/>
        <to usec="0" sec="1557033174"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="37.240.64.132"/>
        </slice>
        <from usec="0" sec="1557032854"/>
        <to usec="0" sec="1557033113"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="176.102.93.220"/>
        </slice>
        <from usec="0" sec="1557033164"/>
        <to usec="0" sec="1557033165"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="71.239.248.92"/>
        </slice>
        <from usec="0" sec="1557033052"/>
        <to usec="0" sec="1557033053"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="50.101.225.248"/>
        </slice>
        <from usec="0" sec="1557032514"/>
        <to usec="0" sec="1557032515"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="129.111.68.81"/>
        </slice>
        <from usec="0" sec="1557032528"/>
        <to usec="0" sec="1557033220"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="104.124.195.172"/>
        </slice>
        <from usec="0" sec="1557032499"/>
        <to usec="0" sec="1557032675"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="139.161.75.73"/>
        </slice>
        <from usec="0" sec="1557032502"/>
        <to usec="0" sec="1557033259"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.164.14.60"/>
        </slice>
        <from usec="0" sec="1557032544"/>
        <to usec="0" sec="1557032545"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06787,1.20222,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="61.161.107.121" src_port="1433"/>
        </slice>
        <from usec="0" sec="1557033157"/>
        <to usec="0" sec="1557033159"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919311,1.16281,010,1 0 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="111.72.220.31" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1557032892"/>
        <to usec="0" sec="1557032898"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,502,0 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.133.231.105"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032508"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,504,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="172.166.9.238" dst_ip="163.45.42.220" src_port="443"/>
            <filter src_ip="172.166.9.238" dst_ip="163.45.42.220" src_port="80"/>
        </slice>
        <from usec="0" sec="1557032418"/>
        <to usec="0" sec="1557032508"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,020,0 0 0 1 0 0 0 0 0 0 0 0,ptpDoSIC">
        <slice>
            <filter dst_ip="194.212.199.72"/>
        </slice>
        <from usec="0" sec="1557032430"/>
        <to usec="0" sec="1557032508"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557033228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,502,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="218.109.255.77"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032688"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,999,0 0 0 1 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="59.134.109.61"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032868"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,999,0 0 0 1 0 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.45.31.167" src_port="53"/>
        </slice>
        <from usec="0" sec="1557032401"/>
        <to usec="0" sec="1557033032"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,999,0 0 0 1 0 0 0 0 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="8.247.244.20" dst_ip="202.133.228.15" src_port="53"/>
        </slice>
        <from usec="0" sec="1557032404"/>
        <to usec="0" sec="1557032865"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,010,0 0 0 1 0 0 0 0 0 0 0 0,sptpDoSSYN">
        <slice>
            <filter src_ip="107.151.86.42" dst_ip="133.5.47.61" dst_port="23"/>
        </slice>
        <from usec="0" sec="1557032405"/>
        <to usec="0" sec="1557032857"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,999,0 0 0 1 0 0 0 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="46.68.183.87" dst_ip="133.5.9.119" dst_port="23"/>
        </slice>
        <from usec="0" sec="1557032415"/>
        <to usec="0" sec="1557032864"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,053,0 0 0 1 0 0 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="122.81.127.221" dst_ip="133.5.0.35" dst_port="80"/>
        </slice>
        <from usec="0" sec="1557032446"/>
        <to usec="0" sec="1557032868"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,020,0 0 0 1 0 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="47.41.236.27"/>
        </slice>
        <from usec="0" sec="1557032506"/>
        <to usec="0" sec="1557032867"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,999,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="187.86.182.237"/>
        </slice>
        <from usec="0" sec="1557032759"/>
        <to usec="0" sec="1557032856"/>
    </anomaly>
    <anomaly type="suspicious" value="0.917236,1.11546,504,1 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.24.65.85" dst_ip="58.230.159.214" src_port="59745" dst_port="443"/>
        </slice>
        <from usec="0" sec="1557032813"/>
        <to usec="0" sec="1557032868"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,504,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="35.108.228.101"/>
        </slice>
        <from usec="0" sec="1557032531"/>
        <to usec="0" sec="1557032957"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,504,0 0 0 1 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter dst_ip="34.178.69.171"/>
        </slice>
        <from usec="0" sec="1557032410"/>
        <to usec="0" sec="1557033048"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,503,0 0 0 1 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="148.27.251.237"/>
        </slice>
        <from usec="0" sec="1557032401"/>
        <to usec="0" sec="1557033138"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557033228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.780274,1.08522,020,0 0 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="80.146.82.225"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557033228"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20593,1.21122,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="130.123.131.215" dst_ip="185.146.250.116" src_port="3389"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032508"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04323,1.18522,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557033228"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04323,1.18522,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557033228"/>
    </anomaly>
    <anomaly type="suspicious" value="1.13243,1.25971,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557033228"/>
    </anomaly>
    <anomaly type="suspicious" value="1.13243,1.25971,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557033228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753937,1.11123,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="107.169.109.112" dst_port="115"/>
        </slice>
        <from usec="0" sec="1557032535"/>
        <to usec="0" sec="1557032581"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753937,1.11123,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="192.254.18.200"/>
        </slice>
        <from usec="0" sec="1557032940"/>
        <to usec="0" sec="1557032986"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753937,1.11123,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.45.31.157"/>
        </slice>
        <from usec="0" sec="1557032940"/>
        <to usec="0" sec="1557032986"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753937,1.11123,020,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.45.31.158"/>
        </slice>
        <from usec="0" sec="1557032940"/>
        <to usec="0" sec="1557032986"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753937,1.11123,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.5.13.187" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1557032940"/>
        <to usec="0" sec="1557032986"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753937,1.11123,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="54.115.144.115"/>
        </slice>
        <from usec="0" sec="1557032940"/>
        <to usec="0" sec="1557032986"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753937,1.11123,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.46.190.239" dst_port="23"/>
        </slice>
        <from usec="0" sec="1557032940"/>
        <to usec="0" sec="1557032986"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753937,1.11123,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.133.224.190" src_port="53"/>
            <filter dst_ip="202.133.224.190" dst_port="53"/>
        </slice>
        <from usec="0" sec="1557032940"/>
        <to usec="0" sec="1557033031"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753937,1.11123,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.46.158.56" dst_port="53"/>
        </slice>
        <from usec="0" sec="1557032940"/>
        <to usec="0" sec="1557033031"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753937,1.11123,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.45.31.174"/>
        </slice>
        <from usec="0" sec="1557033030"/>
        <to usec="0" sec="1557033076"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753937,1.11123,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.45.31.161" src_port="53"/>
        </slice>
        <from usec="0" sec="1557033030"/>
        <to usec="0" sec="1557033076"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753937,1.11123,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.213.81.245" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1557032940"/>
        <to usec="0" sec="1557033211"/>
    </anomaly>
    <anomaly type="suspicious" value="0.753937,1.11123,010,0 0 0 0 0 0 1 0 0 0 0 0,poscaSYN">
        <slice>
            <filter src_ip="173.57.55.162" dst_ip="163.45.147.111" src_port="53101"/>
            <filter src_ip="173.57.55.162" dst_ip="163.45.147.111" src_port="53100"/>
        </slice>
        <from usec="0" sec="1557033120"/>
        <to usec="0" sec="1557033166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,011,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="81.22.45.25" dst_port="59707"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.5.15.59" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032986"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.46.151.196" dst_port="53"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.46.151.193" dst_port="53"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.5.15.91" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032986"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="52.8.253.89"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.213.80.155" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032986"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,010,0 0 0 0 0 0 1 1 1 0 0 0,poscaSYN">
        <slice>
            <filter src_ip="59.219.28.15" dst_ip="133.242.214.143" src_port="52416"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.213.80.138" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032986"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="54.34.164.136"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05527,1.21116,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.45.238.140" dst_port="6881"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,011,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="185.173.217.221" dst_port="55776"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.46.146.62" dst_port="53"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.46.158.57" dst_port="53"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.46.158.56" dst_port="53"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05527,1.21116,020,0 0 0 0 0 0 1 1 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="203.46.157.82"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.213.81.229" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557033211"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,011,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="107.169.111.237" src_port="115"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557032446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05527,1.21116,010,0 0 0 0 0 0 1 1 0 0 0 0,poscaSYN">
        <slice>
            <filter src_ip="59.219.28.15" dst_ip="203.46.205.199" src_port="53010"/>
        </slice>
        <from usec="0" sec="1557032985"/>
        <to usec="0" sec="1557033031"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31025,1.31617,010,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter dst_ip="163.45.61.175" src_port="32766"/>
            <filter src_ip="178.227.108.34" dst_ip="163.45.61.175" src_port="53149"/>
        </slice>
        <from usec="0" sec="1557032400"/>
        <to usec="0" sec="1557033211"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756444,1.05157,999,0 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="139.28.209.145" dst_port="587"/>
            <filter dst_ip="203.46.146.175" src_port="53"/>
            <filter dst_ip="203.46.146.175" dst_port="587"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.729247,1.07838,010,0 0 0 0 0 0 1 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="154.172.2.234" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756444,1.05157,999,0 0 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="203.46.157.76" dst_ip="37.165.221.221"/>
            <filter src_ip="203.46.157.76" src_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.45.253.150" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="104.236.75.45" dst_ip="202.139.192.223" src_port="443"/>
            <filter src_ip="198.228.25.70" dst_ip="202.139.192.223" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.871312,1.03706,999,0 0 0 1 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="163.45.181.224" dst_ip="74.79.130.36" src_port="54435" dst_port="20001"/>
            <filter src_ip="163.45.238.140" dst_ip="74.79.130.36" src_port="36644" dst_port="20001"/>
            <filter src_ip="133.242.109.180" dst_ip="74.79.130.36" src_port="48168" dst_port="20001"/>
            <filter src_ip="133.24.55.5" dst_ip="74.79.130.36" src_port="60037" dst_port="20001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,999,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="203.46.157.70" dst_port="3010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="148.27.251.237" dst_ip="202.133.226.35" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.46.158.57" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,011,0 0 0 0 0 0 0 0 0 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="81.22.45.27" dst_port="57340"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,999,0 0 0 0 0 0 0 0 0 1 1 1,malphfl">
        <slice>
            <filter src_ip="203.46.153.40" dst_ip="216.108.129.98" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,502,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="203.46.149.61" dst_ip="218.109.255.105" src_port="22"/>
            <filter src_ip="203.46.149.61" dst_ip="222.55.102.242" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.45.136.199"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="49.99.80.247" dst_ip="202.133.231.102" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.45.83.47" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="69.62.60.220" dst_ip="202.133.224.144" src_port="80" dst_port="63412"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="163.45.40.102" dst_ip="126.81.201.123" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="74.164.156.24" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.13609,1.15893,010,1 1 1 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="60.98.12.27" dst_port="8443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,504,0 0 0 0 0 0 0 0 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="163.45.202.87" dst_ip="162.234.62.57" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.45.168.212" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="163.45.84.15" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="38.110.231.216" src_port="80"/>
            <filter dst_ip="163.45.145.63" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,999,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="133.24.36.134" dst_ip="192.128.200.232" src_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="222.22.51.38" dst_ip="202.133.231.121" dst_port="443"/>
            <filter src_ip="126.81.197.119" dst_ip="202.133.231.121" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,020,0 0 0 0 0 0 0 0 0 1 1 1,icmp_error">
        <slice>
            <filter dst_ip="203.46.157.102"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.46.133.36" src_port="443"/>
            <filter dst_ip="203.46.133.36" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="133.24.37.65" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878451,1.01899,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="202.139.192.174" dst_ip="60.150.208.66" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
