<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="anomalous" value="1.3214,1.14475,504,1 1 0 1 0 0 1 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="203.178.148.43" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4753,1.8618,504,1 1 1 1 1 1 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="202.200.32.242" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4753,1.8618,504,1 1 1 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="185.177.123.234" src_port="40927"/>
            <filter dst_ip="202.200.32.242" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.72046,1.40872,010,1 1 1 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="89.222.168.1" src_port="54572"/>
            <filter src_ip="178.78.154.241" dst_port="5900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="183.143.149.45" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1573448412"/>
        <to usec="0" sec="1573448933"/>
    </anomaly>
    <anomaly type="anomalous" value="1.30819,1.25575,503,1 1 1 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.178.137.144" dst_port="80"/>
        </slice>
        <from usec="0" sec="1573449210"/>
        <to usec="0" sec="1573449256"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="89.222.167.74"/>
        </slice>
        <from usec="0" sec="1573449247"/>
        <to usec="0" sec="1573449248"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="203.141.115.228" dst_port="445"/>
        </slice>
        <from usec="0" sec="1573449110"/>
        <to usec="0" sec="1573449111"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="121.250.5.44" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1573449287"/>
        <to usec="0" sec="1573449288"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="221.63.132.69" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1573448968"/>
        <to usec="0" sec="1573448971"/>
    </anomaly>
    <anomaly type="anomalous" value="1.79271,1.43623,999,1 1 1 0 0 0 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.178.129.71" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="45.138.189.206" dst_port="1433"/>
            <filter src_ip="45.138.189.206" dst_port="445"/>
        </slice>
        <from usec="0" sec="1573449155"/>
        <to usec="0" sec="1573449161"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="220.137.91.34" dst_port="23"/>
        </slice>
        <from usec="0" sec="1573448773"/>
        <to usec="0" sec="1573448824"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="112.136.12.229" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1573448871"/>
        <to usec="0" sec="1573449177"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="103.135.21.12" dst_port="8291"/>
        </slice>
        <from usec="0" sec="1573448492"/>
        <to usec="0" sec="1573448504"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="202.51.247.173" dst_port="65533"/>
        </slice>
        <from usec="0" sec="1573448823"/>
        <to usec="0" sec="1573448833"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="188.159.146.27" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1573448488"/>
        <to usec="0" sec="1573449072"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="188.159.150.249" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1573448855"/>
        <to usec="0" sec="1573448857"/>
    </anomaly>
    <anomaly type="anomalous" value="1.85417,1.4501,999,1 1 1 1 1 0 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="203.178.137.39" dst_ip="206.35.35.2"/>
            <filter src_ip="203.178.137.39" dst_ip="204.36.18.110"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.26864,1.18289,010,1 1 1 0 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.234.228.217" dst_port="37777"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="124.74.229.193" dst_port="445"/>
        </slice>
        <from usec="0" sec="1573448547"/>
        <to usec="0" sec="1573448548"/>
    </anomaly>
    <anomaly type="anomalous" value="2.10382,1.68905,010,1 1 1 1 1 1 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="62.247.126.145" src_port="7589" dst_port="8291"/>
        </slice>
        <from usec="0" sec="1573448618"/>
        <to usec="0" sec="1573449226"/>
    </anomaly>
    <anomaly type="anomalous" value="1.26864,1.18289,999,1 1 1 0 0 0 0 0 0 1 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="151.29.59.170" src_port="5060" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.49771,1.24646,010,1 1 1 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="89.222.169.49" dst_port="5800"/>
            <filter src_ip="80.146.5.165" src_port="54532"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.26864,1.18289,999,1 1 1 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="133.250.191.208"/>
            <filter src_ip="218.163.61.250" dst_port="65353"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.202.140.5" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1573448476"/>
        <to usec="0" sec="1573448899"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.136.18.66" dst_port="445"/>
        </slice>
        <from usec="0" sec="1573448461"/>
        <to usec="0" sec="1573448462"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="180.77.158.178" dst_port="139"/>
        </slice>
        <from usec="0" sec="1573448973"/>
        <to usec="0" sec="1573448975"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22995,1.20389,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="118.141.152.169" dst_port="445"/>
        </slice>
        <from usec="0" sec="1573448478"/>
        <to usec="0" sec="1573448479"/>
    </anomaly>
    <anomaly type="anomalous" value="1.26864,1.18289,010,1 1 1 0 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="80.146.13.99" dst_port="2083"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.22746,1.70984,504,1 0 0 1 1 1 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.200.32.18" src_port="443"/>
            <filter dst_ip="202.200.32.18" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.14085,1.66863,999,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.178.133.36" dst_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.31379,1.19909,999,1 0 0 1 0 0 1 0 0 1 0 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.178.129.71" src_port="53"/>
            <filter dst_ip="203.178.129.71" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.23208,1.21662,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="203.11.19.252" src_port="23"/>
        </slice>
        <from usec="0" sec="1573448402"/>
        <to usec="0" sec="1573448956"/>
    </anomaly>
    <anomaly type="anomalous" value="1.23208,1.21662,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="36.215.18.99" src_port="11620" dst_port="23"/>
        </slice>
        <from usec="0" sec="1573448403"/>
        <to usec="0" sec="1573448953"/>
    </anomaly>
    <anomaly type="anomalous" value="1.95837,1.54218,010,1 0 0 1 1 1 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="80.146.1.69" src_port="43278"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.23208,1.21662,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="185.177.123.237" src_port="61000" dst_port="80"/>
        </slice>
        <from usec="0" sec="1573448400"/>
        <to usec="0" sec="1573449226"/>
    </anomaly>
    <anomaly type="anomalous" value="2.14085,1.66863,504,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="17.217.94.215" dst_ip="163.218.24.247" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.31539,1.30889,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="203.178.148.43"/>
        </slice>
        <from usec="0" sec="1573448400"/>
        <to usec="0" sec="1573449138"/>
    </anomaly>
    <anomaly type="anomalous" value="1.31539,1.30889,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="203.178.148.43"/>
        </slice>
        <from usec="0" sec="1573448400"/>
        <to usec="0" sec="1573449138"/>
    </anomaly>
    <anomaly type="anomalous" value="2.18674,1.70642,504,0 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="202.200.35.96" src_port="443"/>
            <filter src_ip="192.228.18.111" dst_ip="202.200.32.242" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.75522,1.51607,999,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="185.167.66.151" dst_ip="163.218.48.92" dst_port="53"/>
        </slice>
        <from usec="0" sec="1573448677"/>
        <to usec="0" sec="1573448683"/>
    </anomaly>
    <anomaly type="anomalous" value="1.75522,1.51607,010,0 0 0 1 1 1 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="185.39.21.210" dst_port="123"/>
        </slice>
        <from usec="0" sec="1573448402"/>
        <to usec="0" sec="1573448958"/>
    </anomaly>
    <anomaly type="anomalous" value="1.48459,1.24745,504,1 0 0 1 0 0 1 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="23.163.228.222" dst_ip="203.178.148.43" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34463,1.23563,503,1 1 1 0 0 0 1 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.178.131.177" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.18674,1.70642,503,0 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="117.18.36.247" src_port="80"/>
            <filter src_ip="52.232.255.37" src_port="443"/>
            <filter dst_ip="163.218.23.119" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.28755,1.72279,010,1 1 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="89.222.169.64" src_port="59121"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.29226,1.17506,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.178.131.177" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.44479,1.23188,010,1 1 1 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="5.72.167.146" dst_port="8291"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34463,1.23563,999,1 1 1 0 0 0 1 0 0 1 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="183.125.57.233" src_port="5079" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4753,1.8618,010,1 1 1 1 1 1 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="94.217.178.78" src_port="54491"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35117,1.19033,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.190.74" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.18674,1.70642,010,0 0 0 1 1 1 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="89.222.165.102" src_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36003,1.18001,999,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.178.133.56" dst_port="3010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.29226,1.17506,999,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="202.230.98.197" dst_ip="203.178.133.31" src_port="49562" dst_port="35939"/>
            <filter src_ip="202.230.98.197" dst_ip="203.178.133.31" src_port="49561" dst_port="3010"/>
            <filter src_ip="202.230.98.197" dst_ip="203.178.133.31" src_port="49556" dst_port="38197"/>
            <filter src_ip="202.230.98.197" dst_ip="203.178.133.31" src_port="49555" dst_port="3010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.29226,1.17506,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.178.133.36" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.29226,1.17506,999,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="163.218.243.9" dst_ip="17.223.101.222" src_port="993"/>
            <filter src_ip="163.218.243.21" dst_ip="17.223.101.222" src_port="587"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.51195,1.28261,999,1 1 1 0 0 0 1 0 0 1 1 0,ntscUDPOther">
        <slice>
            <filter src_ip="89.222.168.166" dst_port="1101"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.28755,1.72279,010,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="92.168.83.98" src_port="52876"/>
            <filter src_ip="125.193.255.45" dst_port="179"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.42276,1.24276,504,0 0 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="151.20.145.202" src_port="443"/>
            <filter dst_ip="163.218.48.13" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36694,1.22813,504,0 0 0 0 0 0 1 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="151.20.147.25" dst_ip="163.218.204.219" src_port="443"/>
            <filter src_ip="151.20.44.221" dst_ip="163.218.204.219" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.2611,1.12886,502,1 1 0 0 0 0 1 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="49.25.8.97" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.29226,1.17506,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="151.20.44.134" dst_ip="203.178.129.30" src_port="80" dst_port="39888"/>
            <filter src_ip="151.20.44.134" dst_ip="203.178.129.30" src_port="80" dst_port="39886"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.29226,1.17506,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="94.185.157.193" dst_ip="163.218.154.218"/>
            <filter dst_ip="163.218.154.218" src_port="443"/>
            <filter src_ip="94.185.157.193" dst_ip="163.218.45.130" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.17921,1.17898,503,0 0 0 0 0 0 1 0 0 1 0 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.218.191.46" src_port="443"/>
            <filter dst_ip="163.218.191.46" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.04656,1.14567,503,0 0 0 0 0 0 0 0 0 0 0 1,mptplaHTTP">
        <slice>
            <filter src_ip="203.178.137.144" dst_ip="218.101.52.6" src_port="80"/>
            <filter src_ip="203.178.131.177" dst_ip="218.101.52.6" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.709213,0.970935,503,1 0 0 1 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.218.247.60" dst_port="80"/>
        </slice>
        <from usec="0" sec="1573448730"/>
        <to usec="0" sec="1573449288"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0547,1.07518,504,1 1 0 0 0 0 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="203.178.131.186" dst_port="443"/>
            <filter dst_ip="203.178.131.186" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.903955,1.03855,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="76.31.7.94" dst_ip="133.114.248.54" src_port="59425" dst_port="51032"/>
        </slice>
        <from usec="0" sec="1573448422"/>
        <to usec="0" sec="1573448916"/>
    </anomaly>
    <anomaly type="suspicious" value="0.903955,1.03855,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="3.152.233.86" src_port="20774" dst_port="22"/>
        </slice>
        <from usec="0" sec="1573449021"/>
        <to usec="0" sec="1573449022"/>
    </anomaly>
    <anomaly type="suspicious" value="0.955933,1.01413,999,1 1 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="203.178.129.115" src_port="60217"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.903955,1.03855,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="61.186.91.234" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1573448931"/>
        <to usec="0" sec="1573448939"/>
    </anomaly>
    <anomaly type="suspicious" value="0.903955,1.03855,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="117.220.117.253" dst_port="139"/>
        </slice>
        <from usec="0" sec="1573449115"/>
        <to usec="0" sec="1573449116"/>
    </anomaly>
    <anomaly type="suspicious" value="0.903955,1.03855,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="213.84.254.92" dst_port="65530"/>
        </slice>
        <from usec="0" sec="1573448588"/>
        <to usec="0" sec="1573448598"/>
    </anomaly>
    <anomaly type="suspicious" value="0.798352,1.03291,010,0 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.239.123.94" dst_port="6080"/>
        </slice>
        <from usec="0" sec="1573449297"/>
        <to usec="0" sec="1573449299"/>
    </anomaly>
    <anomaly type="suspicious" value="0.903955,1.03855,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="193.158.224.253" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1573448572"/>
        <to usec="0" sec="1573448574"/>
    </anomaly>
    <anomaly type="suspicious" value="0.903955,1.03855,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="92.199.194.237" dst_port="27017"/>
        </slice>
        <from usec="0" sec="1573448420"/>
        <to usec="0" sec="1573448470"/>
    </anomaly>
    <anomaly type="suspicious" value="0.986337,1.0558,010,1 1 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="218.163.61.250" src_port="65353"/>
            <filter dst_ip="159.51.250.15" src_port="2077"/>
        </slice>
        <from usec="0" sec="1573448400"/>
        <to usec="0" sec="1573448682"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02122,1.1302,010,1 0 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.239.123.94" dst_port="6080"/>
        </slice>
        <from usec="0" sec="1573449220"/>
        <to usec="0" sec="1573449299"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16717,1.20168,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="203.178.148.43"/>
        </slice>
        <from usec="0" sec="1573448400"/>
        <to usec="0" sec="1573449138"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16717,1.20168,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="203.178.148.43"/>
        </slice>
        <from usec="0" sec="1573448400"/>
        <to usec="0" sec="1573449138"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00783,1.09824,999,1 1 0 0 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="203.178.148.43" dst_ip="154.72.99.146"/>
        </slice>
        <from usec="0" sec="1573448532"/>
        <to usec="0" sec="1573448581"/>
    </anomaly>
    <anomaly type="suspicious" value="0.786431,1.00423,999,0 0 0 1 0 0 1 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.218.212.95" src_port="53"/>
            <filter dst_ip="202.198.178.61" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.03039,1.18035,010,0 0 1 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="23.52.98.59"/>
        </slice>
        <from usec="0" sec="1573448402"/>
        <to usec="0" sec="1573449256"/>
    </anomaly>
    <anomaly type="suspicious" value="0.786431,1.00423,999,0 0 0 1 0 0 1 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.218.108.194" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.738813,1.01692,504,1 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.200.32.210" src_port="443"/>
        </slice>
        <from usec="0" sec="1573448437"/>
        <to usec="0" sec="1573449256"/>
    </anomaly>
    <anomaly type="suspicious" value="0.738813,1.01692,010,1 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="23.52.98.59"/>
        </slice>
        <from usec="0" sec="1573448402"/>
        <to usec="0" sec="1573449256"/>
    </anomaly>
    <anomaly type="suspicious" value="0.786431,1.00423,020,0 0 0 1 0 0 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="203.178.141.205" dst_port="53"/>
            <filter dst_ip="203.178.141.205"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.786431,1.00423,010,0 0 0 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="203.178.131.186" dst_port="54748"/>
            <filter dst_ip="150.182.254.138" dst_port="54756"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914305,1.09291,010,0 1 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="23.52.98.59"/>
        </slice>
        <from usec="0" sec="1573448402"/>
        <to usec="0" sec="1573449256"/>
    </anomaly>
    <anomaly type="suspicious" value="0.680257,0.986072,999,0 0 0 0 0 0 1 0 0 1 0 0,salphfl">
        <slice>
            <filter src_ip="23.163.230.88" dst_ip="163.218.48.92" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.722358,1.02888,999,0 0 0 1 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter src_ip="36.88.206.216" dst_ip="202.198.148.123"/>
            <filter dst_ip="202.198.148.123" src_port="53"/>
        </slice>
        <from usec="0" sec="1573448583"/>
        <to usec="0" sec="1573448896"/>
    </anomaly>
    <anomaly type="suspicious" value="0.722358,1.02888,999,0 0 0 1 0 0 1 0 0 0 0 0,DDoSUDP">
        <slice>
            <filter dst_ip="163.218.131.58"/>
        </slice>
        <from usec="0" sec="1573448425"/>
        <to usec="0" sec="1573449206"/>
    </anomaly>
    <anomaly type="suspicious" value="0.722358,1.02888,999,0 0 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="163.218.213.66" dst_port="53"/>
            <filter dst_ip="38.226.217.215" dst_port="53"/>
        </slice>
        <from usec="0" sec="1573448400"/>
        <to usec="0" sec="1573449256"/>
    </anomaly>
    <anomaly type="suspicious" value="0.722358,1.02888,999,0 0 0 1 0 0 1 0 0 0 0 0,DDoSUDP">
        <slice>
            <filter dst_ip="163.218.131.58"/>
        </slice>
        <from usec="0" sec="1573448403"/>
        <to usec="0" sec="1573449256"/>
    </anomaly>
    <anomaly type="suspicious" value="0.722358,1.02888,504,0 0 0 1 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.178.134.103" src_port="443"/>
        </slice>
        <from usec="0" sec="1573448621"/>
        <to usec="0" sec="1573449256"/>
    </anomaly>
    <anomaly type="suspicious" value="0.647986,0.938574,504,0 0 0 1 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="133.198.99.34" dst_ip="13.251.43.236" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.680257,0.986072,010,0 0 0 0 0 0 1 0 0 1 0 0,poscaSYN">
        <slice>
            <filter src_ip="52.242.8.164" dst_ip="203.178.140.44" src_port="32766"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.680257,0.986072,999,0 0 0 0 0 0 1 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="203.178.143.9" dst_ip="142.48.128.64"/>
            <filter src_ip="203.178.143.9" src_port="17733"/>
            <filter src_ip="203.178.143.9" src_port="53"/>
            <filter src_ip="202.200.35.182" dst_ip="142.48.128.64" src_port="17733"/>
            <filter src_ip="202.200.35.182" dst_ip="142.48.128.64" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.666281,0.92545,504,1 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="202.198.178.21" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.680257,0.986072,010,0 0 0 0 0 0 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="23.52.98.59"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.786431,1.00423,010,0 0 0 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="192.92.90.146" dst_port="23"/>
            <filter src_ip="89.222.169.64" src_port="59121"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.947554,0.999615,504,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="163.218.24.246" src_port="443"/>
            <filter dst_ip="163.218.72.206" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.960158,0.987304,504,1 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.218.190.127" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.947554,0.999615,504,0 0 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.218.106.238" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.947554,0.999615,504,0 0 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.218.35.180" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.680257,0.986072,504,0 0 0 0 0 0 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="203.178.148.43" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.666281,0.92545,504,1 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="202.200.35.173" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.666281,0.92545,504,1 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="202.200.36.102" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.861472,0.981373,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="23.190.21.100" dst_ip="77.162.190.42" src_port="443" dst_port="52612"/>
            <filter src_ip="23.190.21.100" dst_ip="77.162.190.42" src_port="443" dst_port="52602"/>
            <filter src_ip="23.190.21.100" dst_ip="77.162.190.42" src_port="443" dst_port="52601"/>
            <filter src_ip="23.190.21.100" dst_ip="77.162.190.42" src_port="443" dst_port="52600"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.947554,0.999615,011,0 0 0 1 0 0 0 0 0 1 1 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="80.146.4.109" dst_port="43385"/>
            <filter dst_ip="89.222.171.167" dst_port="43197"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.960158,0.987304,504,1 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="163.218.107.236" dst_ip="99.86.113.165" src_port="57949" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.861472,0.981373,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.218.110.124" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.861472,0.981373,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="23.179.205.198" dst_ip="163.218.107.32" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.861472,0.981373,010,0 0 0 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="222.2.83.101" src_port="44376" dst_port="5904"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.861472,0.981373,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="203.178.133.31" dst_ip="126.56.106.121" src_port="3010" dst_port="54277"/>
            <filter src_ip="203.178.133.31" dst_ip="126.56.106.121" src_port="3010" dst_port="54275"/>
            <filter src_ip="203.178.133.31" dst_ip="126.56.106.121" src_port="40585" dst_port="54276"/>
            <filter src_ip="203.178.133.31" dst_ip="126.56.106.121" src_port="37483" dst_port="54278"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.861472,0.981373,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="203.178.133.56" dst_ip="126.11.56.214" src_port="3010" dst_port="51857"/>
            <filter src_ip="203.178.133.56" dst_ip="126.11.56.214" src_port="3010" dst_port="51855"/>
            <filter src_ip="203.178.133.56" dst_ip="126.11.56.214" src_port="38189" dst_port="51856"/>
            <filter src_ip="203.178.133.56" dst_ip="126.11.56.214" src_port="35323" dst_port="51858"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.803405,1.00659,504,0 0 0 0 0 0 0 0 0 0 1 0,mptp">
        <slice>
            <filter dst_ip="163.218.188.175" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.960158,0.987304,504,1 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="163.218.188.203" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.861472,0.981373,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.218.191.46" src_port="443"/>
            <filter dst_ip="163.218.191.46" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.861472,0.981373,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.218.190.40" src_port="443"/>
            <filter dst_ip="163.218.190.40" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.803405,1.00659,504,0 0 0 0 0 0 0 0 0 0 1 0,mptp">
        <slice>
            <filter dst_ip="163.218.107.236" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.960158,0.987304,504,1 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.218.106.92" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.861472,0.981373,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter src_ip="208.88.111.77" dst_ip="163.218.9.111" src_port="443"/>
            <filter dst_ip="163.218.9.111"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.969908,1.04434,504,0 0 0 0 0 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.178.129.20" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.861472,0.981373,999,0 0 0 0 0 0 0 0 0 1 1 0,ptpposcaUDP">
        <slice>
            <filter src_ip="203.178.136.41" dst_ip="107.89.153.135" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09177,1.12359,504,0 0 0 0 0 0 0 0 0 1 0 1,mptp">
        <slice>
            <filter dst_ip="163.218.188.175" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09177,1.12359,504,0 0 0 0 0 0 0 0 0 1 0 1,mptp">
        <slice>
            <filter dst_ip="163.218.107.236" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
