<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="suspicious" value="0.876469,1.24163,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="203.146.141.215" dst_ip="203.146.141.215" proto="tcp"/>
        </slice>
        <from usec="0" sec="1583211652"/>
        <to usec="0" sec="1583211730"/>
    </anomaly>
    <anomaly type="suspicious" value="0.983394,1.22446,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.47.218.203" dst_ip="13.141.182.14" src_port="55626" dst_port="443"/>
            <filter src_ip="133.47.218.203" dst_ip="13.141.182.14" src_port="55625" dst_port="443"/>
            <filter src_ip="133.47.218.203" dst_ip="13.141.182.14" src_port="55624" dst_port="443"/>
        </slice>
        <from usec="0" sec="1583211998"/>
        <to usec="0" sec="1583211999"/>
    </anomaly>
    <anomaly type="suspicious" value="0.983394,1.22446,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="195.215.167.166" dst_port="445"/>
        </slice>
        <from usec="0" sec="1583212054"/>
        <to usec="0" sec="1583212056"/>
    </anomaly>
    <anomaly type="suspicious" value="0.983394,1.22446,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="124.5.221.0" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1583212078"/>
        <to usec="0" sec="1583212081"/>
    </anomaly>
    <anomaly type="suspicious" value="0.983394,1.22446,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="36.112.159.10" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1583212008"/>
        <to usec="0" sec="1583212019"/>
    </anomaly>
    <anomaly type="suspicious" value="0.983394,1.22446,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="144.91.125.45" dst_port="445"/>
        </slice>
        <from usec="0" sec="1583212015"/>
        <to usec="0" sec="1583212019"/>
    </anomaly>
    <anomaly type="suspicious" value="0.983394,1.22446,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="94.26.187.174" dst_port="445"/>
        </slice>
        <from usec="0" sec="1583212270"/>
        <to usec="0" sec="1583212273"/>
    </anomaly>
    <anomaly type="suspicious" value="0.983394,1.22446,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="221.55.85.58" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1583211872"/>
        <to usec="0" sec="1583211874"/>
    </anomaly>
    <anomaly type="suspicious" value="0.983394,1.22446,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.161.1.206" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1583212392"/>
        <to usec="0" sec="1583212393"/>
    </anomaly>
    <anomaly type="suspicious" value="0.983394,1.22446,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="126.234.24.87" dst_ip="202.116.38.86" src_port="60070" dst_port="443"/>
            <filter src_ip="126.234.24.87" dst_ip="202.116.38.86" src_port="60069" dst_port="443"/>
            <filter src_ip="126.234.24.87" dst_ip="202.116.38.86" src_port="60068" dst_port="443"/>
            <filter src_ip="126.234.24.87" dst_ip="202.116.38.86" src_port="60067" dst_port="443"/>
            <filter src_ip="126.234.24.87" dst_ip="202.116.38.86" src_port="60066" dst_port="443"/>
        </slice>
        <from usec="0" sec="1583211616"/>
        <to usec="0" sec="1583211617"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02978,1.30852,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="203.146.141.215" dst_ip="203.146.141.215" proto="tcp"/>
        </slice>
        <from usec="0" sec="1583211652"/>
        <to usec="0" sec="1583211730"/>
    </anomaly>
    <anomaly type="suspicious" value="0.74454,1.10101,504,1 0 0 1 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.218.55.104" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21191,1.32961,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1583211600"/>
        <to usec="0" sec="1583212428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21191,1.32961,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1583211600"/>
        <to usec="0" sec="1583212428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.33921,1.51487,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1583211600"/>
        <to usec="0" sec="1583212428"/>
    </anomaly>
    <anomaly type="suspicious" value="1.33921,1.51487,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1583211600"/>
        <to usec="0" sec="1583212428"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="192.110.95.33" dst_port="9160"/>
        </slice>
        <from usec="0" sec="1583211600"/>
        <to usec="0" sec="1583211646"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="39.125.211.48" dst_port="8181"/>
        </slice>
        <from usec="0" sec="1583211600"/>
        <to usec="0" sec="1583211646"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="51.146.97.158" dst_port="7443"/>
        </slice>
        <from usec="0" sec="1583211600"/>
        <to usec="0" sec="1583211646"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="51.146.97.156" dst_port="9444"/>
        </slice>
        <from usec="0" sec="1583211600"/>
        <to usec="0" sec="1583211646"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="192.110.96.66" dst_port="9030"/>
        </slice>
        <from usec="0" sec="1583211600"/>
        <to usec="0" sec="1583211646"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="192.110.99.206" dst_port="9160"/>
        </slice>
        <from usec="0" sec="1583211600"/>
        <to usec="0" sec="1583211646"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,999,0 0 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter dst_ip="185.193.227.214" dst_port="53"/>
        </slice>
        <from usec="0" sec="1583211600"/>
        <to usec="0" sec="1583211646"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="51.146.97.158" dst_port="2080"/>
        </slice>
        <from usec="0" sec="1583211735"/>
        <to usec="0" sec="1583211781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="192.110.89.100" dst_port="9030"/>
        </slice>
        <from usec="0" sec="1583211735"/>
        <to usec="0" sec="1583211781"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.146.128.40" dst_port="53"/>
        </slice>
        <from usec="0" sec="1583211780"/>
        <to usec="0" sec="1583211826"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="203.146.148.243" dst_port="9030"/>
        </slice>
        <from usec="0" sec="1583211870"/>
        <to usec="0" sec="1583211916"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="192.110.96.66"/>
        </slice>
        <from usec="0" sec="1583211870"/>
        <to usec="0" sec="1583211916"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.146.128.40" dst_port="53"/>
        </slice>
        <from usec="0" sec="1583211870"/>
        <to usec="0" sec="1583211916"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="192.110.84.171" dst_port="9030"/>
        </slice>
        <from usec="0" sec="1583211915"/>
        <to usec="0" sec="1583211961"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="193.248.2.230" src_port="25"/>
        </slice>
        <from usec="0" sec="1583212095"/>
        <to usec="0" sec="1583212141"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.146.135.97" dst_port="123"/>
            <filter src_ip="185.193.227.214" dst_ip="203.146.135.97" src_port="53"/>
            <filter src_ip="194.129.31.22" dst_ip="203.146.135.97" src_port="53"/>
        </slice>
        <from usec="0" sec="1583211870"/>
        <to usec="0" sec="1583212501"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="51.90.116.144" dst_port="2096"/>
        </slice>
        <from usec="0" sec="1583212185"/>
        <to usec="0" sec="1583212231"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="192.110.102.113" dst_port="993"/>
        </slice>
        <from usec="0" sec="1583212320"/>
        <to usec="0" sec="1583212366"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="51.146.97.156"/>
        </slice>
        <from usec="0" sec="1583212320"/>
        <to usec="0" sec="1583212366"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="54.189.36.237"/>
        </slice>
        <from usec="0" sec="1583212410"/>
        <to usec="0" sec="1583212456"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,999,0 0 0 0 0 0 1 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="203.146.148.243" dst_ip="203.146.135.235" dst_port="53"/>
        </slice>
        <from usec="0" sec="1583212410"/>
        <to usec="0" sec="1583212456"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="35.85.27.154"/>
        </slice>
        <from usec="0" sec="1583212410"/>
        <to usec="0" sec="1583212456"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,999,0 0 0 0 0 0 1 0 0 0 0 0,DDoSUDP">
        <slice>
            <filter dst_ip="133.253.64.111"/>
        </slice>
        <from usec="0" sec="1583212410"/>
        <to usec="0" sec="1583212456"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="51.146.97.159" dst_port="587"/>
        </slice>
        <from usec="0" sec="1583212410"/>
        <to usec="0" sec="1583212456"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="51.146.97.158" dst_port="8881"/>
        </slice>
        <from usec="0" sec="1583212410"/>
        <to usec="0" sec="1583212456"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="133.4.73.14" dst_port="23"/>
        </slice>
        <from usec="0" sec="1583212410"/>
        <to usec="0" sec="1583212456"/>
    </anomaly>
    <anomaly type="suspicious" value="0.86137,1.27838,011,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="104.176.161.199"/>
        </slice>
        <from usec="0" sec="1583212455"/>
        <to usec="0" sec="1583212501"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09662,1.17871,999,1 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="203.146.130.223" dst_ip="175.65.155.44"/>
            <filter src_ip="203.146.130.223" src_port="3001"/>
            <filter dst_ip="175.65.155.44" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.788219,1.12789,504,0 0 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.218.190.30" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.48.174" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.841648,1.11262,503,1 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.218.224.2" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.74454,1.10101,502,1 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="213.33.3.26" dst_port="8080"/>
            <filter dst_ip="49.88.143.117" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.902588,1.23739,999,0 0 0 0 0 0 1 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="203.146.128.56" dst_ip="49.184.245.52" src_port="1194"/>
            <filter src_ip="203.146.132.67" dst_ip="49.184.245.52" src_port="1194"/>
            <filter src_ip="203.146.132.122" dst_ip="49.184.245.52" src_port="1194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.74454,1.10101,504,1 0 0 1 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="13.141.18.24" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="163.218.31.69" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="13.110.95.173" dst_ip="177.145.83.149" src_port="443" dst_port="49404"/>
            <filter src_ip="13.110.95.173" dst_ip="177.145.83.149" src_port="443" dst_port="49403"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.905624,1.10896,502,1 0 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="218.88.243.198" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="133.27.26.224" dst_ip="141.105.165.147" src_port="25"/>
            <filter src_ip="133.27.26.224" dst_ip="158.74.73.92" src_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="13.252.200.204" dst_ip="163.218.107.42" src_port="443" dst_port="51602"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="134.45.185.236" dst_ip="163.218.30.75" src_port="443" dst_port="60672"/>
            <filter src_ip="134.45.185.236" dst_ip="163.218.30.75" src_port="443" dst_port="60671"/>
            <filter src_ip="134.45.185.236" dst_ip="163.218.30.75" src_port="443" dst_port="60482"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.146.128.28" src_port="443"/>
            <filter src_ip="1.49.28.238" dst_ip="203.146.128.28" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="163.218.38.185" dst_port="123"/>
            <filter src_ip="163.218.38.185" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="17.250.118.144" dst_ip="163.218.31.150" src_port="443" dst_port="57686"/>
            <filter src_ip="17.250.118.144" dst_ip="163.218.31.150" src_port="443" dst_port="57685"/>
            <filter src_ip="17.250.118.144" dst_ip="163.218.31.150" src_port="443" dst_port="57684"/>
            <filter src_ip="17.250.118.144" dst_ip="163.218.31.150" src_port="443" dst_port="57683"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="193.54.27.79" dst_ip="203.146.148.243" src_port="443" dst_port="50652"/>
            <filter src_ip="193.54.27.79" dst_ip="163.218.31.140" src_port="80" dst_port="36982"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="23.218.84.20" dst_ip="203.146.128.29" src_port="443"/>
            <filter src_ip="23.218.84.20" dst_ip="163.218.55.121" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.788219,1.12789,010,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="31.192.104.205" src_port="51432"/>
            <filter src_ip="163.54.95.249" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="34.167.151.133" dst_ip="163.218.190.162" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.38.129" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.190.155" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,010,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="82.33.97.9" src_port="29011"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,999,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.146.130.229"/>
            <filter src_ip="203.146.130.198" src_port="3001"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="202.116.38.86" dst_ip="126.210.250.61" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.188.67" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05617,1.19314,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.121.5.168" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.14646,1.17526,504,1 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.121.5.75" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.188.22" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.191.24" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05617,1.19314,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.188.14" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.31.159" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.30.21" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.75.206" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.115.52" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.218.133.55" src_port="443"/>
            <filter dst_ip="163.218.189.178" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00186,1.19654,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="203.146.137.167" dst_ip="23.45.110.220" src_port="51890" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55804,1.45401,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="159.78.145.219" dst_port="139"/>
        </slice>
        <from usec="0" sec="1583211600"/>
        <to usec="0" sec="1583211730"/>
    </anomaly>
    <anomaly type="anomalous" value="1.48157,1.32671,504,1 1 1 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.218.45.90" dst_port="443"/>
            <filter src_ip="163.218.45.90"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36254,1.35857,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="188.208.120.182"/>
        </slice>
        <from usec="0" sec="1583211928"/>
        <to usec="0" sec="1583211929"/>
    </anomaly>
    <anomaly type="anomalous" value="1.6399,1.3826,999,1 1 1 0 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.146.141.19" dst_ip="206.91.164.7"/>
            <filter src_ip="203.146.141.19" dst_ip="204.25.172.82"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36254,1.35857,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="149.24.204.2" src_port="5061" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1583212481"/>
        <to usec="0" sec="1583212482"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36254,1.35857,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="117.119.228.39"/>
        </slice>
        <from usec="0" sec="1583212053"/>
        <to usec="0" sec="1583212054"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36254,1.35857,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="223.103.230.40"/>
        </slice>
        <from usec="0" sec="1583212172"/>
        <to usec="0" sec="1583212173"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36254,1.35857,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="213.33.3.221" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1583211761"/>
        <to usec="0" sec="1583212354"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36254,1.35857,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="193.134.9.120" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1583211772"/>
        <to usec="0" sec="1583212373"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36254,1.35857,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.30.114.178" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1583212197"/>
        <to usec="0" sec="1583212201"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36254,1.35857,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="171.144.203.72" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1583211687"/>
        <to usec="0" sec="1583211689"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36254,1.35857,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.9.202.184" dst_port="1433"/>
            <filter src_ip="112.9.202.184" dst_port="445"/>
        </slice>
        <from usec="0" sec="1583212340"/>
        <to usec="0" sec="1583212346"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36254,1.35857,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="188.95.92.80" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1583211772"/>
        <to usec="0" sec="1583212401"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36254,1.35857,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.161.1.207" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1583211786"/>
        <to usec="0" sec="1583212492"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36254,1.35857,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.161.1.202" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1583211628"/>
        <to usec="0" sec="1583212338"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36254,1.35857,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="175.202.192.226"/>
        </slice>
        <from usec="0" sec="1583211843"/>
        <to usec="0" sec="1583211844"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36254,1.35857,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="124.72.79.223"/>
        </slice>
        <from usec="0" sec="1583212223"/>
        <to usec="0" sec="1583212225"/>
    </anomaly>
    <anomaly type="anomalous" value="1.56502,1.33795,999,1 1 0 1 1 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="126.196.135.124"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5812,1.41811,999,1 1 1 0 0 0 1 0 0 1 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="77.23.93.42" src_port="5084" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.14632,1.7387,010,0 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="92.149.212.202" src_port="51326"/>
            <filter src_ip="45.48.110.64" src_port="48354"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.50844,1.87162,999,1 1 1 1 1 1 1 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="94.139.51.12" src_port="47005" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.50844,1.87162,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="163.218.116.56" src_port="6000" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.83631,1.47374,010,1 1 1 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="45.48.110.64" src_port="48354"/>
            <filter src_ip="45.48.110.69" src_port="48360"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.4784,4.84632,999,1 1 1 1 1 0 1 1 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="126.196.135.124"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.19216,1.72648,010,1 0 0 1 1 1 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="45.48.110.69" src_port="48360"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.00891,1.65971,020,0 0 0 1 1 1 0 0 0 1 1 1,ntscICec">
        <slice>
            <filter src_ip="46.20.69.97"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.05781,1.6469,504,1 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.116.33.212" src_port="443"/>
            <filter dst_ip="202.116.33.212" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.89857,1.46768,010,1 1 1 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="195.215.167.164" src_port="8080"/>
            <filter src_ip="195.215.167.164" src_port="43356"/>
            <filter src_ip="195.215.167.168" src_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.6162,1.33539,503,1 0 0 1 1 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="66.155.1.237" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.05781,1.6469,999,1 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.146.130.198" dst_port="3001"/>
            <filter dst_ip="203.146.130.198"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.00891,1.65971,999,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.146.130.229"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.67363,1.37966,503,1 1 1 1 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="66.155.1.237" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36988,1.29699,999,1 1 0 0 0 0 1 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="162.120.185.222" dst_ip="203.146.132.67" dst_port="1194"/>
            <filter src_ip="162.120.185.222" dst_ip="203.146.132.122" dst_port="1194"/>
            <filter src_ip="162.120.185.222" dst_ip="203.146.128.56" dst_port="1194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.48157,1.32671,503,1 1 1 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="202.116.33.212" dst_port="443"/>
            <filter src_ip="202.116.33.212" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.00891,1.65971,999,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.146.130.223"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78969,1.63974,504,0 0 0 1 1 1 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.218.104.38" src_port="443"/>
        </slice>
        <from usec="0" sec="1583211600"/>
        <to usec="0" sec="1583212239"/>
    </anomaly>
    <anomaly type="anomalous" value="2.00891,1.65971,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.218.57.169" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.67363,1.37966,010,1 1 1 1 0 0 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="206.58.223.85" src_port="45608" dst_port="22002"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.3826,1.24782,999,1 1 0 1 0 0 0 0 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.121.49.60" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.05781,1.6469,504,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.218.30.128"/>
            <filter src_ip="17.253.119.143" src_port="80"/>
            <filter dst_ip="163.218.148.6" src_port="443"/>
            <filter dst_ip="163.218.190.198" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.19216,1.72648,504,1 0 0 1 1 1 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.146.137.167" src_port="443"/>
            <filter dst_ip="203.146.137.167" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.69641,1.42143,999,1 1 1 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="37.17.155.180" src_port="40638" dst_port="7740"/>
            <filter src_ip="187.164.91.29" src_port="3654" dst_port="9090"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.19216,1.72648,010,1 0 0 1 1 1 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="45.48.110.69" src_port="48360"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
