<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="suspicious" value="0.90261,1.27714,504,1 1 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.196.47.18" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.29773,1.44304,504,1 1 1 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.85.67.254" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07537,1.31141,504,1 1 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.76.147.44" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="172.87.225.125"/>
        </slice>
        <from usec="0" sec="1562475867"/>
        <to usec="0" sec="1562476417"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.149.112.73"/>
        </slice>
        <from usec="0" sec="1562476353"/>
        <to usec="0" sec="1562476354"/>
    </anomaly>
    <anomaly type="suspicious" value="1.27026,1.50721,010,1 1 1 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="23.103.36.165" src_port="6000"/>
        </slice>
        <from usec="0" sec="1562475645"/>
        <to usec="0" sec="1562475691"/>
    </anomaly>
    <anomaly type="suspicious" value="1.29773,1.44304,999,1 1 1 0 0 0 0 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="77.38.15.93" src_port="5077" dst_port="5161"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="171.166.218.247" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1562476126"/>
        <to usec="0" sec="1562476129"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04206,1.38171,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="112.122.242.248" dst_port="445"/>
        </slice>
        <from usec="0" sec="1562475956"/>
        <to usec="0" sec="1562476231"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.236.160.78" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1562475842"/>
        <to usec="0" sec="1562475853"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="79.246.70.33" dst_port="445"/>
        </slice>
        <from usec="0" sec="1562476408"/>
        <to usec="0" sec="1562476411"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.157.179.157" dst_port="65529"/>
            <filter src_ip="58.157.179.157" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1562476013"/>
        <to usec="0" sec="1562476075"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="202.173.33.237" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1562476013"/>
        <to usec="0" sec="1562476015"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="37.143.137.155"/>
        </slice>
        <from usec="0" sec="1562476332"/>
        <to usec="0" sec="1562476334"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="155.95.31.13"/>
        </slice>
        <from usec="0" sec="1562476085"/>
        <to usec="0" sec="1562476086"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="176.81.175.195"/>
        </slice>
        <from usec="0" sec="1562476424"/>
        <to usec="0" sec="1562476425"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="71.18.198.51"/>
        </slice>
        <from usec="0" sec="1562475997"/>
        <to usec="0" sec="1562475998"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="192.125.39.171"/>
        </slice>
        <from usec="0" sec="1562476146"/>
        <to usec="0" sec="1562476147"/>
    </anomaly>
    <anomaly type="suspicious" value="1.2429,1.4529,999,1 1 1 0 0 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.76.142.54" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09026,1.40717,020,1 1 1 0 0 0 0 0 0 1 0 0,ntscICec">
        <slice>
            <filter src_ip="62.4.0.182"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09026,1.40717,504,1 1 1 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="202.196.40.137" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09026,1.40717,503,1 1 1 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.85.11.24" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="103.161.219.223" src_port="22" dst_port="22"/>
        </slice>
        <from usec="0" sec="1562476176"/>
        <to usec="0" sec="1562476179"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="77.38.15.44" src_port="5338" dst_port="5065"/>
        </slice>
        <from usec="0" sec="1562476487"/>
        <to usec="0" sec="1562476500"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="124.225.51.60" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1562476229"/>
        <to usec="0" sec="1562476231"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="185.220.102.146" dst_port="1422"/>
        </slice>
        <from usec="0" sec="1562476381"/>
        <to usec="0" sec="1562476493"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="61.225.97.118" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1562475981"/>
        <to usec="0" sec="1562475996"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="159.79.37.119"/>
        </slice>
        <from usec="0" sec="1562475928"/>
        <to usec="0" sec="1562475929"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="104.126.84.172"/>
        </slice>
        <from usec="0" sec="1562476471"/>
        <to usec="0" sec="1562476473"/>
    </anomaly>
    <anomaly type="suspicious" value="1.37808,1.42471,999,1 1 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="3.246.233.63" src_port="3283" dst_port="9023"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00103,1.37069,504,0 0 0 1 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="126.14.247.229"/>
        </slice>
        <from usec="0" sec="1562475656"/>
        <to usec="0" sec="1562475677"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00103,1.37069,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="203.79.152.32"/>
        </slice>
        <from usec="0" sec="1562475600"/>
        <to usec="0" sec="1562475888"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00103,1.37069,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="203.79.152.32"/>
        </slice>
        <from usec="0" sec="1562475600"/>
        <to usec="0" sec="1562475888"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04642,1.39375,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="203.79.152.32"/>
        </slice>
        <from usec="0" sec="1562475600"/>
        <to usec="0" sec="1562475888"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04642,1.39375,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="203.79.152.32"/>
        </slice>
        <from usec="0" sec="1562475600"/>
        <to usec="0" sec="1562475888"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07904,1.42025,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="203.79.152.32"/>
        </slice>
        <from usec="0" sec="1562475600"/>
        <to usec="0" sec="1562475888"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07904,1.42025,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="203.79.152.32"/>
        </slice>
        <from usec="0" sec="1562475600"/>
        <to usec="0" sec="1562475888"/>
    </anomaly>
    <anomaly type="suspicious" value="1.27026,1.50721,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="174.251.5.161" dst_port="81"/>
        </slice>
        <from usec="0" sec="1562475600"/>
        <to usec="0" sec="1562475691"/>
    </anomaly>
    <anomaly type="suspicious" value="1.27026,1.50721,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="213.75.46.125" src_port="5317" dst_port="35160"/>
        </slice>
        <from usec="0" sec="1562475600"/>
        <to usec="0" sec="1562475737"/>
    </anomaly>
    <anomaly type="suspicious" value="1.30327,1.45755,999,1 1 1 0 0 0 1 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="133.4.189.181" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.42837,1.48767,010,1 1 1 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="185.220.102.78" src_port="40516"/>
            <filter src_ip="107.41.1.144" dst_port="8945"/>
            <filter src_ip="77.38.15.95" src_port="5063" dst_port="15476"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.27026,1.50721,012,1 1 1 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.11.25.102" dst_ip="201.194.179.174" dst_port="25"/>
        </slice>
        <from usec="0" sec="1562475601"/>
        <to usec="0" sec="1562476501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.925423,1.24089,504,1 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="104.239.139.186" dst_ip="163.85.234.133" src_port="443" dst_port="54874"/>
            <filter src_ip="104.239.139.186" dst_ip="163.85.234.133" src_port="443" dst_port="54870"/>
            <filter src_ip="104.239.139.186" dst_ip="163.85.234.133" src_port="443" dst_port="54869"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.10115,1.29251,999,1 0 0 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="92.71.75.131" dst_port="55326"/>
            <filter dst_ip="18.98.91.114" src_port="3283" dst_port="9002"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.29773,1.44304,999,1 1 1 0 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter dst_ip="203.76.138.192"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.925423,1.24089,999,1 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="203.76.131.250" src_port="3010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07537,1.31141,504,1 1 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="202.25.21.254" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.42837,1.48767,999,1 1 1 0 0 0 1 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="51.168.110.28" src_port="5130" dst_port="5060"/>
            <filter src_ip="51.168.110.28" src_port="5152" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12136,1.46318,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="42.98.16.90"/>
        </slice>
        <from usec="0" sec="1562475927"/>
        <to usec="0" sec="1562475928"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="202.202.215.88" src_port="443"/>
            <filter src_ip="202.202.215.88" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,011,0 0 0 0 0 0 0 0 0 1 1 1,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="89.48.176.165" dst_port="47912"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.76.147.44" src_port="443"/>
            <filter src_ip="208.130.223.94" dst_ip="203.76.147.44" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.42837,1.48767,504,1 1 1 0 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.25.21.254" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="157.130.165.142" dst_ip="203.76.147.44" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.76.146.213" src_port="443"/>
            <filter dst_ip="203.76.146.213" src_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.42837,1.48767,010,1 1 1 0 0 0 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="23.103.36.186" src_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="203.76.147.44" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.07537,1.31141,010,1 1 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="46.154.2.157"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="18.87.231.109" dst_ip="163.85.52.174" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.85.67.99" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.85.66.81" src_port="443"/>
            <filter dst_ip="163.85.66.81" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,503,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="84.9.182.102" src_port="443"/>
            <filter src_ip="84.9.182.102" src_port="80"/>
            <filter dst_ip="163.85.65.168" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.85.242.237" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.26455,1.36007,503,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.76.132.83" dst_port="80"/>
            <filter dst_ip="203.76.138.71" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,010,0 0 0 0 0 0 0 0 0 1 1 1,sptpDoSSYN">
        <slice>
            <filter src_ip="46.154.10.16" dst_ip="203.76.134.115" dst_port="53"/>
            <filter src_ip="114.229.2.63" dst_ip="203.76.134.115" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="133.17.99.160" dst_ip="23.88.109.137" src_port="61036" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="133.17.245.17" dst_ip="54.191.73.71" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.76.131.243"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="163.85.66.85" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,010,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="198.20.45.242" src_port="29011"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.76.181.245" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.76.141.205" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="74.178.239.1" dst_ip="163.85.153.16" src_port="443" dst_port="48402"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="185.220.102.201" dst_ip="163.85.208.67" src_port="443" dst_port="52180"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.85.142.195" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="202.196.47.203" dst_ip="182.105.195.89" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.828272,1.22893,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="133.17.163.198" dst_ip="50.39.18.21" src_port="80"/>
            <filter src_ip="133.17.163.198" dst_ip="50.39.18.21" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.12685,1.82898,901,1 1 1 1 1 1 1 0 0 1 1 1,empty">
        <slice/>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.80621,1.66316,999,1 1 1 1 1 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.76.138.192" dst_ip="206.84.227.225"/>
            <filter src_ip="203.76.138.192" dst_ip="204.213.213.156"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78025,1.62551,999,0 0 0 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="203.76.131.221" src_port="3010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.87761,1.66526,999,0 0 0 1 1 1 1 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="219.101.61.201" dst_ip="203.76.131.250"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65609,1.64342,999,0 0 0 1 1 1 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="133.4.191.30" dst_ip="120.56.39.250" src_port="23"/>
        </slice>
        <from usec="0" sec="1562475601"/>
        <to usec="0" sec="1562476336"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78025,1.62551,999,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter src_ip="1.138.253.42" dst_ip="203.76.131.196"/>
            <filter src_ip="1.138.253.42" dst_port="3001"/>
            <filter dst_ip="203.76.131.196" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65609,1.64342,010,0 0 0 1 1 1 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="58.54.230.242" src_port="49736" dst_port="445"/>
        </slice>
        <from usec="0" sec="1562475602"/>
        <to usec="0" sec="1562476424"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92244,1.6741,504,1 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter src_ip="89.48.176.165" src_port="47912"/>
            <filter src_ip="89.48.188.150" src_port="47941"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65609,1.64342,010,0 0 0 1 1 1 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="47.100.226.246" src_port="30841" dst_port="23"/>
        </slice>
        <from usec="0" sec="1562475603"/>
        <to usec="0" sec="1562476243"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78025,1.62551,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="163.85.240.5" src_port="80"/>
            <filter src_ip="163.85.8.246" src_port="80"/>
            <filter src_ip="163.85.240.5" dst_ip="182.105.212.193" src_port="443"/>
            <filter src_ip="163.85.240.5" dst_ip="60.121.119.223" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.65609,1.64342,999,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="202.196.45.80" dst_ip="107.63.38.203" src_port="53"/>
            <filter src_ip="203.76.142.54" dst_ip="107.63.38.203" src_port="53"/>
        </slice>
        <from usec="0" sec="1562476220"/>
        <to usec="0" sec="1562476335"/>
    </anomaly>
    <anomaly type="anomalous" value="3.45156,3.00052,999,1 0 0 0 0 0 1 1 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="67.246.159.133" dst_ip="203.76.147.45" dst_port="123"/>
            <filter src_ip="67.246.159.133" dst_ip="202.196.40.128" dst_port="123"/>
            <filter src_ip="67.246.159.133" dst_ip="203.76.138.183" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.8469,5.08065,999,0 0 0 0 0 0 1 1 1 1 0 0,ptmpla">
        <slice>
            <filter src_ip="1.27.167.154" dst_ip="203.76.147.45" dst_port="123"/>
            <filter src_ip="1.27.167.154" dst_ip="203.76.138.183" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78429,1.6384,999,0 0 0 1 1 1 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="202.196.47.173" src_port="53"/>
            <filter dst_ip="202.196.47.173" dst_port="53"/>
            <filter dst_ip="203.76.141.205" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78025,1.62551,010,0 0 0 1 1 1 0 0 0 1 1 1,sntscSYN">
        <slice>
            <filter src_ip="167.70.165.120" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.63519,1.59375,011,0 0 0 1 1 1 0 0 0 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="52.133.45.222" dst_ip="163.85.153.5" src_port="50441"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.82747,1.63457,504,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="216.221.13.233" src_port="443"/>
            <filter dst_ip="202.196.47.136" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78025,1.62551,504,0 0 0 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="74.178.232.150" dst_ip="163.85.191.43" src_port="443"/>
            <filter src_ip="74.178.232.150" dst_ip="163.85.142.220" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.56036,1.49115,503,1 0 0 1 1 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.76.132.83" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78025,1.62551,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.85.142.220" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78025,1.62551,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.85.243.86" src_port="443"/>
            <filter dst_ip="163.85.233.170" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78025,1.62551,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.76.147.44" src_port="443"/>
            <filter dst_ip="163.85.198.44" src_port="443"/>
            <filter dst_ip="163.85.254.204" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78025,1.62551,504,0 0 0 1 1 1 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="183.194.92.227" dst_ip="163.85.99.76" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.90779,1.68873,999,1 1 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.76.131.196" dst_ip="1.138.253.42"/>
            <filter src_ip="203.76.131.196" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.82747,1.63457,999,1 0 0 1 1 1 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="219.101.61.201" dst_ip="203.76.131.250"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92244,1.6741,504,1 0 0 1 1 1 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.202.215.27" src_port="53"/>
            <filter dst_ip="202.202.215.27" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
