<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="suspicious" value="0.998241,1.22396,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="139.96.140.241"/>
        </slice>
        <from usec="0" sec="1568005336"/>
        <to usec="0" sec="1568005997"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="35.73.148.248"/>
        </slice>
        <from usec="0" sec="1568005512"/>
        <to usec="0" sec="1568005514"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754295,1.12009,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="203.193.124.18" dst_ip="72.218.20.193" src_port="63308" dst_port="55440"/>
        </slice>
        <from usec="0" sec="1568005219"/>
        <to usec="0" sec="1568006048"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,504,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="104.244.48.229" dst_ip="203.193.124.18" src_port="443" dst_port="52696"/>
        </slice>
        <from usec="0" sec="1568005659"/>
        <to usec="0" sec="1568005873"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="121.48.180.228" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1568005203"/>
        <to usec="0" sec="1568006099"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,504,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="74.130.158.197" dst_ip="163.170.129.11" src_port="443" dst_port="61742"/>
            <filter src_ip="74.130.158.197" dst_ip="163.170.129.11" src_port="443" dst_port="61741"/>
        </slice>
        <from usec="0" sec="1568005582"/>
        <to usec="0" sec="1568005723"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754295,1.12009,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="36.103.110.63" dst_ip="203.193.101.111" src_port="49064" dst_port="80"/>
        </slice>
        <from usec="0" sec="1568005928"/>
        <to usec="0" sec="1568005932"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754295,1.12009,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="61.221.77.65" dst_ip="203.193.101.111" src_port="50142" dst_port="80"/>
        </slice>
        <from usec="0" sec="1568005934"/>
        <to usec="0" sec="1568005939"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,504,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="202.244.25.176" src_port="443"/>
        </slice>
        <from usec="0" sec="1568005201"/>
        <to usec="0" sec="1568005991"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754295,1.12009,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.170.230.84" dst_ip="207.232.44.48" src_port="443" dst_port="5067"/>
        </slice>
        <from usec="0" sec="1568005663"/>
        <to usec="0" sec="1568005665"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="37.16.129.163"/>
        </slice>
        <from usec="0" sec="1568005435"/>
        <to usec="0" sec="1568005605"/>
    </anomaly>
    <anomaly type="suspicious" value="1.13594,1.18253,999,1 1 1 0 0 0 0 0 0 1 1 0,ntscUDPOther">
        <slice>
            <filter src_ip="51.178.173.238" src_port="5105" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.11539,1.24379,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="219.130.18.32" dst_port="3306"/>
        </slice>
        <from usec="0" sec="1568005830"/>
        <to usec="0" sec="1568005876"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.236.113.16"/>
        </slice>
        <from usec="0" sec="1568005291"/>
        <to usec="0" sec="1568005984"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="119.241.83.219" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1568005627"/>
        <to usec="0" sec="1568005830"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05589,1.12729,504,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="203.193.103.177" dst_ip="35.85.72.179" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="42.65.57.91"/>
        </slice>
        <from usec="0" sec="1568005202"/>
        <to usec="0" sec="1568005606"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="185.143.100.7"/>
        </slice>
        <from usec="0" sec="1568005634"/>
        <to usec="0" sec="1568005960"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="111.221.227.234"/>
        </slice>
        <from usec="0" sec="1568005824"/>
        <to usec="0" sec="1568006066"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="155.79.1.7"/>
        </slice>
        <from usec="0" sec="1568005606"/>
        <to usec="0" sec="1568005916"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="124.31.38.234" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1568006085"/>
        <to usec="0" sec="1568006086"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.106.94.185"/>
        </slice>
        <from usec="0" sec="1568005651"/>
        <to usec="0" sec="1568005652"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="185.248.64.145"/>
        </slice>
        <from usec="0" sec="1568005789"/>
        <to usec="0" sec="1568005968"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="23.108.35.86"/>
        </slice>
        <from usec="0" sec="1568005302"/>
        <to usec="0" sec="1568005303"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="176.137.176.14"/>
        </slice>
        <from usec="0" sec="1568005440"/>
        <to usec="0" sec="1568005692"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="155.79.46.155"/>
        </slice>
        <from usec="0" sec="1568005249"/>
        <to usec="0" sec="1568005251"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754295,1.12009,010,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="51.171.229.110" src_port="41022"/>
        </slice>
        <from usec="0" sec="1568005322"/>
        <to usec="0" sec="1568005325"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754295,1.12009,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="183.192.87.9" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1568005945"/>
        <to usec="0" sec="1568005947"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754295,1.12009,010,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="188.68.82.252" dst_port="22"/>
        </slice>
        <from usec="0" sec="1568005275"/>
        <to usec="0" sec="1568005286"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.93.2.229" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1568005934"/>
        <to usec="0" sec="1568005939"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="31.210.73.8" dst_port="445"/>
        </slice>
        <from usec="0" sec="1568005930"/>
        <to usec="0" sec="1568005932"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754295,1.12009,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.85.47.53" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1568005766"/>
        <to usec="0" sec="1568005767"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="31.210.73.55" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1568005280"/>
        <to usec="0" sec="1568005294"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="106.218.16.129" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1568005642"/>
        <to usec="0" sec="1568005791"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754295,1.12009,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="115.238.72.186" dst_port="445"/>
        </slice>
        <from usec="0" sec="1568005695"/>
        <to usec="0" sec="1568005698"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.133.22.120" dst_port="445"/>
        </slice>
        <from usec="0" sec="1568005220"/>
        <to usec="0" sec="1568006015"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754295,1.12009,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="58.54.153.67" dst_port="1433"/>
            <filter src_ip="58.54.153.67" dst_port="445"/>
        </slice>
        <from usec="0" sec="1568005272"/>
        <to usec="0" sec="1568005284"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754295,1.12009,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.133.22.119" dst_port="445"/>
        </slice>
        <from usec="0" sec="1568005726"/>
        <to usec="0" sec="1568005729"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.133.14.76" dst_port="445"/>
        </slice>
        <from usec="0" sec="1568005483"/>
        <to usec="0" sec="1568005485"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754295,1.12009,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.133.14.90" dst_port="445"/>
        </slice>
        <from usec="0" sec="1568005740"/>
        <to usec="0" sec="1568005743"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="49.204.124.86" dst_port="445"/>
        </slice>
        <from usec="0" sec="1568005871"/>
        <to usec="0" sec="1568005872"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.51.90.140" dst_port="13611"/>
            <filter src_ip="220.51.90.140" dst_port="13601"/>
        </slice>
        <from usec="0" sec="1568005597"/>
        <to usec="0" sec="1568005602"/>
    </anomaly>
    <anomaly type="suspicious" value="0.776518,1.08733,999,1 1 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="133.59.65.227"/>
            <filter src_ip="92.119.102.91" dst_port="33339"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754295,1.12009,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="183.192.87.249" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1568005945"/>
        <to usec="0" sec="1568005947"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="122.99.100.19" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1568005601"/>
        <to usec="0" sec="1568005602"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="41.30.125.109" dst_port="445"/>
        </slice>
        <from usec="0" sec="1568005322"/>
        <to usec="0" sec="1568005325"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="122.37.203.177" dst_port="445"/>
        </slice>
        <from usec="0" sec="1568005539"/>
        <to usec="0" sec="1568005544"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754295,1.12009,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.133.12.42" dst_port="445"/>
            <filter src_ip="112.133.12.42" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1568005669"/>
        <to usec="0" sec="1568005682"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.133.12.36" dst_port="445"/>
            <filter src_ip="112.133.12.36" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1568005755"/>
        <to usec="0" sec="1568005759"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="122.251.68.73" dst_port="445"/>
        </slice>
        <from usec="0" sec="1568005761"/>
        <to usec="0" sec="1568005763"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754295,1.12009,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="182.242.206.115" dst_port="23"/>
        </slice>
        <from usec="0" sec="1568005562"/>
        <to usec="0" sec="1568005573"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="41.179.113.212" dst_port="445"/>
        </slice>
        <from usec="0" sec="1568005316"/>
        <to usec="0" sec="1568005320"/>
    </anomaly>
    <anomaly type="suspicious" value="0.754295,1.12009,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="123.214.203.217" dst_port="445"/>
        </slice>
        <from usec="0" sec="1568005634"/>
        <to usec="0" sec="1568005637"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="107.158.168.202"/>
        </slice>
        <from usec="0" sec="1568005369"/>
        <to usec="0" sec="1568005370"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="71.252.246.131"/>
        </slice>
        <from usec="0" sec="1568005861"/>
        <to usec="0" sec="1568005863"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="139.96.211.147"/>
        </slice>
        <from usec="0" sec="1568005541"/>
        <to usec="0" sec="1568005905"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="220.51.90.140" src_port="13611"/>
            <filter dst_ip="220.51.90.140" src_port="13601"/>
        </slice>
        <from usec="0" sec="1568005597"/>
        <to usec="0" sec="1568005602"/>
    </anomaly>
    <anomaly type="suspicious" value="0.951495,1.19858,020,0 0 0 1 0 0 0 0 0 0 0 0,ptpDoSIC">
        <slice>
            <filter dst_ip="37.68.100.116"/>
        </slice>
        <from usec="0" sec="1568005201"/>
        <to usec="0" sec="1568005296"/>
    </anomaly>
    <anomaly type="suspicious" value="0.951495,1.19858,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1568005200"/>
        <to usec="0" sec="1568006028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.951495,1.19858,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="67.76.104.95"/>
        </slice>
        <from usec="0" sec="1568005201"/>
        <to usec="0" sec="1568005397"/>
    </anomaly>
    <anomaly type="suspicious" value="0.951495,1.19858,502,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.36.36.9" src_port="22"/>
        </slice>
        <from usec="0" sec="1568005204"/>
        <to usec="0" sec="1568005938"/>
    </anomaly>
    <anomaly type="suspicious" value="0.951495,1.19858,901,0 0 0 1 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1568005200"/>
        <to usec="0" sec="1568006028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.951495,1.19858,010,0 0 0 1 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="142.74.122.122"/>
        </slice>
        <from usec="0" sec="1568005200"/>
        <to usec="0" sec="1568005668"/>
    </anomaly>
    <anomaly type="suspicious" value="0.951495,1.19858,010,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="46.153.121.114"/>
        </slice>
        <from usec="0" sec="1568005200"/>
        <to usec="0" sec="1568005667"/>
    </anomaly>
    <anomaly type="suspicious" value="0.951495,1.19858,010,0 0 0 1 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="81.58.169.2"/>
        </slice>
        <from usec="0" sec="1568005200"/>
        <to usec="0" sec="1568005758"/>
    </anomaly>
    <anomaly type="suspicious" value="0.951495,1.19858,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="114.30.7.170"/>
        </slice>
        <from usec="0" sec="1568005200"/>
        <to usec="0" sec="1568005758"/>
    </anomaly>
    <anomaly type="suspicious" value="0.951495,1.19858,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="175.195.147.77"/>
        </slice>
        <from usec="0" sec="1568005203"/>
        <to usec="0" sec="1568005933"/>
    </anomaly>
    <anomaly type="suspicious" value="0.951495,1.19858,010,0 0 0 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="218.18.158.183"/>
        </slice>
        <from usec="0" sec="1568005204"/>
        <to usec="0" sec="1568005927"/>
    </anomaly>
    <anomaly type="suspicious" value="0.951495,1.19858,010,0 0 0 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="204.110.142.27"/>
        </slice>
        <from usec="0" sec="1568005215"/>
        <to usec="0" sec="1568005934"/>
    </anomaly>
    <anomaly type="suspicious" value="1.14395,1.27299,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1568005200"/>
        <to usec="0" sec="1568005398"/>
    </anomaly>
    <anomaly type="suspicious" value="1.14395,1.27299,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1568005200"/>
        <to usec="0" sec="1568005668"/>
    </anomaly>
    <anomaly type="suspicious" value="1.2381,1.34277,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1568005200"/>
        <to usec="0" sec="1568005398"/>
    </anomaly>
    <anomaly type="suspicious" value="0.746094,1.11544,020,1 0 0 0 0 0 1 0 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="35.72.191.101"/>
        </slice>
        <from usec="0" sec="1568005425"/>
        <to usec="0" sec="1568005984"/>
    </anomaly>
    <anomaly type="suspicious" value="1.2083,1.2529,504,1 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.170.20.180" src_port="443"/>
            <filter dst_ip="163.170.20.180" src_port="80"/>
        </slice>
        <from usec="0" sec="1568005605"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18199,1.24089,999,0 0 0 0 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="104.22.181.132" dst_port="123"/>
            <filter src_ip="104.22.177.146" dst_port="123"/>
            <filter dst_ip="163.170.200.164" dst_port="123"/>
            <filter dst_ip="202.244.28.251" dst_port="123"/>
            <filter dst_ip="202.244.25.188" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,011,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="183.183.9.186" dst_ip="203.193.124.18" src_port="443"/>
        </slice>
        <from usec="0" sec="1568005650"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.193.105.212" dst_port="53"/>
        </slice>
        <from usec="0" sec="1568005650"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.59.65.209" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1568005425"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.193.105.196" dst_port="53"/>
        </slice>
        <from usec="0" sec="1568005650"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.948803,1.20153,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.59.65.138" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1568005425"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.193.103.70" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1568005200"/>
        <to usec="0" sec="1568005741"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.170.217.145" src_port="53"/>
            <filter dst_ip="163.170.217.145"/>
        </slice>
        <from usec="0" sec="1568005650"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.59.48.190" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1568005650"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="35.115.15.74"/>
        </slice>
        <from usec="0" sec="1568005650"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.59.48.169" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1568005200"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,010,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="51.176.237.251" src_port="80"/>
        </slice>
        <from usec="0" sec="1568005650"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18199,1.24089,999,0 0 0 0 0 0 1 1 1 1 0 0,alphfl">
        <slice>
            <filter src_ip="123.209.34.227" dst_ip="203.193.111.249" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,010,0 0 0 0 0 0 1 1 1 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="163.170.142.64" src_port="32766"/>
        </slice>
        <from usec="0" sec="1568005200"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.59.66.85" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1568005650"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.59.66.14" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1568005425"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.10107,1.23323,504,1 0 0 0 0 0 0 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.170.65.192" src_port="443"/>
        </slice>
        <from usec="0" sec="1568005625"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="0.948803,1.20153,504,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.170.172.40" src_port="443"/>
        </slice>
        <from usec="0" sec="1568005425"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.59.49.122" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1568005425"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="150.59.49.105" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1568005425"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.170.110.171" src_port="443"/>
            <filter src_ip="182.158.215.181" dst_ip="163.170.110.171" src_port="80"/>
        </slice>
        <from usec="0" sec="1568005200"/>
        <to usec="0" sec="1568005741"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05615,1.25029,999,0 0 0 0 0 0 0 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.250.37.224" dst_port="53"/>
        </slice>
        <from usec="0" sec="1568005650"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05615,1.25029,020,0 0 0 0 0 0 0 1 1 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="3.51.25.51"/>
        </slice>
        <from usec="0" sec="1568005650"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05615,1.25029,010,0 0 0 0 0 0 0 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.170.141.187" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1568005650"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05615,1.25029,999,0 0 0 0 0 0 0 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.193.101.123" dst_port="53"/>
        </slice>
        <from usec="0" sec="1568005650"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05615,1.25029,504,0 0 0 0 0 0 0 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.170.120.189" src_port="443"/>
        </slice>
        <from usec="0" sec="1568005650"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05615,1.25029,020,0 0 0 0 0 0 0 1 1 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="184.31.228.150"/>
        </slice>
        <from usec="0" sec="1568005650"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05615,1.25029,020,0 0 0 0 0 0 0 1 1 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="99.177.194.119"/>
        </slice>
        <from usec="0" sec="1568005650"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.193.121.238" src_port="443"/>
        </slice>
        <from usec="0" sec="1568005425"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05615,1.25029,504,0 0 0 0 0 0 0 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.170.19.230" src_port="443"/>
        </slice>
        <from usec="0" sec="1568005650"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16751,1.2697,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.193.98.77" dst_port="53"/>
        </slice>
        <from usec="0" sec="1568005425"/>
        <to usec="0" sec="1568005741"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18199,1.24089,504,0 0 0 0 0 0 1 1 1 1 0 0,mptmp">
        <slice>
            <filter dst_ip="163.170.132.104" src_port="443"/>
            <filter dst_ip="163.170.32.93" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.776472,1.0467,504,1 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="198.216.120.36" dst_ip="163.170.142.93" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,011,0 0 0 0 0 0 0 0 0 1 1 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="185.124.84.179" dst_port="41914"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.13594,1.18253,503,1 1 1 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.170.140.235" src_port="443"/>
            <filter dst_ip="163.170.140.235" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.776472,1.0467,504,1 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="163.170.141.51" src_port="443"/>
            <filter dst_ip="163.170.142.237" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,999,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="222.206.80.105" dst_ip="203.193.104.248" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.928885,1.07465,504,1 1 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.193.124.18" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,502,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="133.177.168.241" src_port="22"/>
            <filter src_ip="133.177.168.241"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="203.193.124.18" dst_port="443"/>
            <filter src_ip="203.193.124.18" dst_ip="163.170.20.165" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05589,1.12729,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="133.36.195.31" dst_ip="100.223.214.37" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="139.96.43.91" dst_port="8081"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="150.8.3.112" dst_ip="163.170.68.136" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="159.161.248.22" src_port="58201" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,999,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="163.170.242.22" dst_ip="64.11.80.47" src_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="163.170.77.181" dst_ip="65.89.25.90" src_port="59401" dst_port="443"/>
            <filter src_ip="163.170.77.181" dst_ip="65.89.25.90" src_port="44901" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="163.170.58.189" dst_ip="65.201.19.141" dst_port="443"/>
            <filter src_ip="163.170.58.189" dst_ip="111.173.205.188" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05589,1.12729,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="173.95.176.89" dst_ip="163.170.65.108" src_port="443"/>
            <filter src_ip="173.95.176.89" dst_ip="163.170.53.38" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05589,1.12729,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="173.95.184.248" dst_ip="163.170.143.59" src_port="443" dst_port="34013"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="182.22.231.141" dst_ip="133.59.65.196" dst_port="23"/>
            <filter src_ip="182.22.231.141" src_port="9565" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,502,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="202.244.26.33" dst_ip="112.85.41.174" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="203.193.98.68" src_port="443"/>
            <filter src_ip="203.193.98.68" dst_ip="186.67.179.23" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,502,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="203.193.103.80" src_port="22"/>
            <filter src_ip="203.193.103.80" dst_port="45700"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,502,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="211.254.228.116" dst_ip="203.193.103.44" dst_port="22"/>
            <filter src_ip="211.254.228.116" dst_ip="203.193.103.2" dst_port="143"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05589,1.12729,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.193.124.18" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05589,1.12729,504,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="212.227.3.144" dst_ip="163.170.65.200" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05589,1.12729,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.170.143.104" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.10083,1.10834,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.170.69.202" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="71.230.167.142" src_port="29011"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="94.103.207.113" dst_port="80"/>
            <filter src_ip="94.103.207.113" dst_port="10001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="91.178.247.84" src_port="50553" dst_port="1080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="94.102.41.107" src_port="51624"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.776472,1.0467,504,1 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="203.193.101.101" dst_ip="126.210.197.131" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,502,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="133.59.65.140" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05589,1.12729,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="172.89.58.245" src_port="443"/>
            <filter dst_ip="163.170.65.48" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.170.142.178" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.170.64.159" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05589,1.12729,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05589,1.12729,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.170.127.236" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05589,1.12729,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.170.34.74" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.170.29.24" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.998241,1.22396,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="106.144.204.187" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1568005860"/>
        <to usec="0" sec="1568005862"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05589,1.12729,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.170.31.163" src_port="443"/>
            <filter dst_ip="163.170.31.39" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,011,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter src_ip="133.59.65.225" dst_ip="189.130.17.90" src_port="23"/>
            <filter dst_ip="189.130.17.90" src_port="23" dst_port="34086"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,999,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="133.59.65.150" dst_ip="77.118.108.216"/>
            <filter src_ip="133.59.65.150" src_port="23"/>
            <filter src_ip="133.59.65.128" dst_ip="77.118.108.216"/>
            <filter src_ip="133.59.65.128" src_port="23"/>
            <filter dst_ip="77.118.108.216" src_port="23"/>
            <filter dst_ip="77.118.108.216" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,504,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="202.239.251.90" dst_ip="202.244.28.62" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,504,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="202.244.26.188" src_port="443"/>
            <filter dst_ip="163.170.65.239" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,504,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="163.170.65.82" dst_ip="35.94.92.69" src_port="55245" dst_port="443"/>
            <filter src_ip="163.170.65.82" dst_ip="35.94.92.69" src_port="55242" dst_port="443"/>
            <filter src_ip="163.170.172.43" dst_ip="35.94.92.69" src_port="61870" dst_port="443"/>
            <filter src_ip="163.170.140.65" dst_ip="35.94.92.69" src_port="49505" dst_port="443"/>
            <filter src_ip="163.170.132.134" dst_ip="35.94.92.69" src_port="35586" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711339,1.06674,999,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="203.193.105.196" dst_ip="91.219.87.129" src_port="587"/>
            <filter src_ip="203.193.105.226" dst_ip="91.219.87.129" src_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92066,1.45362,999,1 1 1 1 1 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.193.104.248" dst_ip="206.180.226.255"/>
            <filter src_ip="203.193.104.248" dst_ip="204.53.45.161"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.1406,1.56041,999,1 1 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.193.97.116" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.10056,1.49799,503,1 1 0 1 1 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.193.104.83" dst_port="80"/>
            <filter dst_ip="203.193.101.111" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.48206,1.74724,999,1 1 1 1 1 1 1 1 1 1 1 1,alphfl">
        <slice>
            <filter src_ip="81.178.176.227" dst_ip="163.170.83.160" dst_port="6595"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.19768,1.57601,010,1 1 0 1 1 1 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="89.4.151.35" src_port="46461"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.82279,1.54429,010,0 0 0 1 1 1 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="140.4.224.73" src_port="63557" dst_port="81"/>
            <filter src_ip="140.4.224.73" src_port="63557" dst_port="8000"/>
        </slice>
        <from usec="0" sec="1568005200"/>
        <to usec="0" sec="1568005575"/>
    </anomaly>
    <anomaly type="anomalous" value="1.82279,1.54429,010,0 0 0 1 1 1 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="114.22.201.190" src_port="59067" dst_port="23"/>
        </slice>
        <from usec="0" sec="1568005205"/>
        <to usec="0" sec="1568006024"/>
    </anomaly>
    <anomaly type="anomalous" value="2.079,1.54129,503,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.193.104.83" src_port="80"/>
            <filter src_ip="203.193.101.111" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.03493,1.60404,999,1 1 1 1 1 1 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="74.160.34.241"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.46541,1.36841,012,1 1 1 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.52.57.136" dst_ip="201.34.178.17" dst_port="25"/>
        </slice>
        <from usec="0" sec="1568005200"/>
        <to usec="0" sec="1568006100"/>
    </anomaly>
    <anomaly type="anomalous" value="2.35621,1.7088,999,1 1 1 1 1 1 1 1 1 1 1 0,ptmp">
        <slice>
            <filter src_ip="74.160.34.241"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.24015,1.20303,999,1 1 1 0 0 0 1 0 0 1 1 0,ntscUDPOther">
        <slice>
            <filter src_ip="94.189.229.116" src_port="5141" dst_port="6060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.29288,1.65145,010,1 1 1 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="89.4.151.83"/>
            <filter src_ip="185.57.51.85" src_port="49402"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.43397,1.34576,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.170.89.185" dst_port="53"/>
        </slice>
        <from usec="0" sec="1568005200"/>
        <to usec="0" sec="1568005696"/>
    </anomaly>
    <anomaly type="anomalous" value="1.32436,1.2477,504,1 1 0 0 0 0 1 1 1 1 0 0,alphfl">
        <slice>
            <filter src_ip="202.244.31.120" dst_ip="219.101.130.197" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.1406,1.56041,999,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.193.97.103" dst_port="3010"/>
            <filter dst_ip="203.193.97.82" dst_port="3010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.24015,1.20303,010,1 1 1 0 0 0 1 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="121.38.137.145" dst_port="79"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.05557,1.55497,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.170.100.132" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.26367,1.636,504,1 1 0 1 1 1 1 1 1 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.250.9.195" dst_port="53"/>
            <filter src_ip="202.250.9.195" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.079,1.54129,504,1 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.170.110.174" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.05557,1.55497,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="185.60.146.163" src_port="443"/>
            <filter dst_ip="163.170.69.207" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.70429,1.36109,020,0 0 0 1 1 0 0 0 0 1 1 1,ttl_error">
        <slice>
            <filter src_ip="203.193.109.242"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.28722,1.2298,999,0 0 0 0 0 0 1 1 1 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.193.97.105" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.21315,1.13478,999,1 1 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="92.119.102.91" src_port="33339"/>
            <filter src_ip="133.59.65.228" dst_ip="60.49.126.154" src_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.16727,1.14878,020,0 0 0 0 0 0 1 0 0 1 1 1,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="18.26.50.18"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.05557,1.55497,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.244.31.151" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.33949,1.65832,504,1 0 0 1 1 1 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.193.110.54" src_port="443"/>
            <filter dst_ip="203.193.110.54" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.16727,1.14878,020,0 0 0 0 0 0 1 0 0 1 1 1,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="34.170.56.67"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.28722,1.2298,999,0 0 0 0 0 0 1 1 1 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.193.124.18" src_port="53"/>
            <filter dst_ip="163.170.216.130" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.33949,1.65832,010,1 0 0 1 1 1 1 1 1 1 1 1,ptmp">
        <slice>
            <filter src_ip="185.50.156.151" src_port="50029"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.93479,1.45073,504,1 1 1 1 0 0 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.250.9.245" src_port="443"/>
            <filter src_ip="208.189.193.222" dst_ip="202.250.9.245" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.31868,1.67105,504,0 0 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter src_ip="51.176.0.158" dst_port="990"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.50527,1.28267,504,0 0 0 0 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="117.48.236.130" src_port="443"/>
            <filter dst_ip="163.170.6.228" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.74648,1.38046,504,1 1 1 0 0 0 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.250.9.195" src_port="53"/>
            <filter dst_ip="202.250.9.195" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.53713,1.26605,504,1 0 0 0 0 0 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.244.28.178" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.74648,1.38046,504,1 1 1 0 0 0 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.250.49.122" src_port="443"/>
            <filter dst_ip="202.250.49.122" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.19768,1.57601,504,1 1 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.37814,1.23742,504,1 1 1 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.170.9.137" src_port="443"/>
            <filter dst_ip="163.170.64.72" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.74648,1.38046,504,1 1 1 0 0 0 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.193.98.101" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.53713,1.26605,504,1 0 0 0 0 0 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.244.31.105" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.50527,1.28267,504,0 0 0 0 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter src_ip="189.130.17.90" src_port="34086" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
