<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="suspicious" value="1.54005,1.63781,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="202.137.208.107" dst_ip="8.131.13.7" dst_port="80"/>
        </slice>
        <from usec="0" sec="1585976400"/>
        <to usec="0" sec="1585977217"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17319,1.46086,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="34.77.86.114"/>
        </slice>
        <from usec="0" sec="1585977295"/>
        <to usec="0" sec="1585977296"/>
    </anomaly>
    <anomaly type="suspicious" value="1.54005,1.63781,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="35.203.210.98"/>
        </slice>
        <from usec="0" sec="1585977230"/>
        <to usec="0" sec="1585977231"/>
    </anomaly>
    <anomaly type="suspicious" value="1.54005,1.63781,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.118.137.255" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1585976851"/>
        <to usec="0" sec="1585977103"/>
    </anomaly>
    <anomaly type="suspicious" value="1.54005,1.63781,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="180.46.111.115" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1585976883"/>
        <to usec="0" sec="1585977001"/>
    </anomaly>
    <anomaly type="suspicious" value="1.54005,1.63781,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.208.103.180" dst_port="445"/>
        </slice>
        <from usec="0" sec="1585976773"/>
        <to usec="0" sec="1585976776"/>
    </anomaly>
    <anomaly type="suspicious" value="1.54005,1.63781,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.66.168.84" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1585977296"/>
        <to usec="0" sec="1585977300"/>
    </anomaly>
    <anomaly type="suspicious" value="1.54005,1.63781,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="193.105.45.166" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1585976542"/>
        <to usec="0" sec="1585977243"/>
    </anomaly>
    <anomaly type="suspicious" value="1.54005,1.63781,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="116.224.127.126" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1585976930"/>
        <to usec="0" sec="1585976935"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17319,1.46086,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="157.39.83.146" dst_port="445"/>
        </slice>
        <from usec="0" sec="1585976439"/>
        <to usec="0" sec="1585976442"/>
    </anomaly>
    <anomaly type="suspicious" value="1.54005,1.63781,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="106.66.129.127" dst_port="445"/>
        </slice>
        <from usec="0" sec="1585976934"/>
        <to usec="0" sec="1585976937"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22911,1.41599,010,1 1 0 1 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="103.141.6.19" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.54005,1.63781,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="211.214.175.68" dst_port="445"/>
        </slice>
        <from usec="0" sec="1585977180"/>
        <to usec="0" sec="1585977183"/>
    </anomaly>
    <anomaly type="suspicious" value="1.54005,1.63781,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="188.161.160.229" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1585976469"/>
        <to usec="0" sec="1585977282"/>
    </anomaly>
    <anomaly type="suspicious" value="1.54005,1.63781,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.89.209.13" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1585976585"/>
        <to usec="0" sec="1585977067"/>
    </anomaly>
    <anomaly type="suspicious" value="1.54005,1.63781,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.89.209.12" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1585976478"/>
        <to usec="0" sec="1585976992"/>
    </anomaly>
    <anomaly type="suspicious" value="1.54005,1.63781,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.89.209.11" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1585976493"/>
        <to usec="0" sec="1585977199"/>
    </anomaly>
    <anomaly type="suspicious" value="1.54005,1.63781,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="188.161.164.3" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1585976575"/>
        <to usec="0" sec="1585977265"/>
    </anomaly>
    <anomaly type="suspicious" value="1.54005,1.63781,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="5.86.218.255" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1585977245"/>
        <to usec="0" sec="1585977247"/>
    </anomaly>
    <anomaly type="suspicious" value="1.54005,1.63781,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICecrqICecrqdurmterp">
        <slice>
            <filter dst_ip="159.42.71.251"/>
        </slice>
        <from usec="0" sec="1585976904"/>
        <to usec="0" sec="1585976909"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17319,1.46086,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="202.137.211.192" dst_ip="168.60.170.22" dst_port="443"/>
            <filter src_ip="202.137.211.192" dst_ip="34.80.153.11" dst_port="443"/>
        </slice>
        <from usec="0" sec="1585976774"/>
        <to usec="0" sec="1585976776"/>
    </anomaly>
    <anomaly type="suspicious" value="1.3309,1.36442,020,1 0 0 1 0 0 0 0 0 1 1 1,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="142.35.44.113" src_port="52869"/>
            <filter dst_ip="142.35.44.113"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21193,1.46021,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1585976400"/>
        <to usec="0" sec="1585977138"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21193,1.46021,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1585976400"/>
        <to usec="0" sec="1585976598"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18494,1.43763,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="1.220.46.67" src_port="11872" dst_port="23"/>
        </slice>
        <from usec="0" sec="1585976415"/>
        <to usec="0" sec="1585977225"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18494,1.43763,020,0 0 0 1 1 0 0 0 0 0 0 0,ttl_error">
        <slice>
            <filter src_ip="129.122.26.155" dst_ip="203.13.106.240"/>
            <filter src_ip="129.122.26.155" dst_ip="203.13.106.225"/>
            <filter src_ip="129.122.26.155" dst_ip="203.13.106.215"/>
            <filter src_ip="129.122.26.155" dst_ip="203.13.106.206"/>
            <filter src_ip="129.122.26.155" dst_ip="203.13.99.8"/>
        </slice>
        <from usec="0" sec="1585976458"/>
        <to usec="0" sec="1585977015"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18494,1.43763,010,0 0 0 1 1 0 0 0 0 0 0 0,sptpDoSSYN">
        <slice>
            <filter src_ip="65.116.152.84" dst_ip="203.13.109.175" dst_port="53"/>
            <filter src_ip="84.209.20.85" dst_ip="203.13.109.175" dst_port="53"/>
        </slice>
        <from usec="0" sec="1585976400"/>
        <to usec="0" sec="1585977227"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18494,1.43763,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="13.100.197.6" dst_port="443"/>
        </slice>
        <from usec="0" sec="1585976423"/>
        <to usec="0" sec="1585977228"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18494,1.43763,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="202.137.214.79" dst_ip="126.178.109.87" src_port="993"/>
        </slice>
        <from usec="0" sec="1585977195"/>
        <to usec="0" sec="1585977228"/>
    </anomaly>
    <anomaly type="suspicious" value="1.49055,1.66055,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1585976400"/>
        <to usec="0" sec="1585977138"/>
    </anomaly>
    <anomaly type="suspicious" value="1.49055,1.66055,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1585976400"/>
        <to usec="0" sec="1585976598"/>
    </anomaly>
    <anomaly type="suspicious" value="0.983828,1.37379,010,1 0 0 0 0 0 1 0 0 0 0 0,poscaSYN">
        <slice>
            <filter src_ip="206.66.64.189" dst_ip="203.13.97.249" src_port="32766"/>
        </slice>
        <from usec="0" sec="1585976580"/>
        <to usec="0" sec="1585976841"/>
    </anomaly>
    <anomaly type="suspicious" value="0.983828,1.37379,010,1 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="195.206.146.23" src_port="43037"/>
        </slice>
        <from usec="0" sec="1585976670"/>
        <to usec="0" sec="1585976716"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06126,1.301,504,1 0 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.13.98.230" src_port="53"/>
            <filter dst_ip="203.13.98.230" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08151,1.373,010,0 0 0 0 0 0 1 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="162.244.242.51" dst_port="1723"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06126,1.301,504,1 0 0 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.137.208.100" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20233,1.39486,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="203.13.106.220" src_port="3010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17512,1.3712,999,0 0 0 1 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.13.106.205" src_port="80"/>
            <filter src_ip="203.13.106.205"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17512,1.3712,503,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.222.90.197"/>
            <filter dst_ip="163.222.240.40" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.3309,1.36442,504,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.222.66.190" src_port="443"/>
            <filter src_ip="18.148.99.243" dst_ip="163.222.232.83" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.32287,1.41022,010,0 0 0 1 0 0 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="195.206.147.247" src_port="43031"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20233,1.39486,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="163.222.130.190" src_port="54695"/>
            <filter src_ip="163.222.130.190" dst_port="7680"/>
            <filter src_ip="163.222.130.190" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05118,1.34895,999,0 0 0 1 0 0 1 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.13.102.56" dst_port="53"/>
            <filter dst_ip="133.229.222.174" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.37106,1.45382,502,1 1 0 1 0 0 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="218.188.1.58" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.89475,1.33288,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.222.172.220" dst_port="443"/>
            <filter src_ip="163.222.172.220"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20233,1.39486,999,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.222.210.149" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.89475,1.33288,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="126.117.93.231" dst_ip="163.222.89.42" src_port="62442" dst_port="60391"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20233,1.39486,999,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.13.106.205"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.41287,1.4304,504,0 0 0 1 1 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.222.117.92" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20233,1.39486,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="163.222.9.205" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.89475,1.33288,054,0 0 0 0 0 0 0 0 0 1 1 0,point_to_point">
        <slice>
            <filter src_ip="163.222.200.113" dst_ip="193.36.246.34" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.89475,1.33288,504,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="163.222.120.247" dst_port="443"/>
            <filter src_ip="203.13.113.236" dst_ip="52.99.143.237" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.89475,1.33288,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="171.186.200.68" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20233,1.39486,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.222.118.214" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.35498,1.3882,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.222.120.247" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20233,1.39486,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="163.222.130.60" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.89475,1.33288,010,0 0 0 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="203.13.113.236" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.89475,1.33288,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="89.7.24.67" src_port="29011"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17512,1.3712,504,0 0 0 1 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="202.137.214.105" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17512,1.3712,999,0 0 0 1 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.13.108.170" src_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20233,1.39486,999,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="202.137.214.79" dst_ip="126.65.15.129" src_port="993"/>
            <filter src_ip="202.137.208.25" dst_ip="126.65.15.129" src_port="587"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17512,1.3712,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.222.9.205" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20233,1.39486,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.222.97.118" src_port="443"/>
            <filter dst_ip="163.222.97.227" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20233,1.39486,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.222.120.131" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06126,1.301,503,1 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="203.13.103.111" dst_port="80"/>
            <filter dst_ip="163.222.212.152" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17512,1.3712,503,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.13.98.168" src_port="443"/>
            <filter dst_ip="203.13.98.168" src_port="80"/>
            <filter dst_ip="203.13.98.168" dst_port="25"/>
            <filter dst_ip="133.229.218.71" src_port="80"/>
            <filter dst_ip="133.229.218.71" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.89475,1.33288,504,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="203.13.98.34" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.89475,1.33288,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="163.222.234.98" dst_ip="208.130.171.216" src_port="17185"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.89475,1.33288,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="203.13.108.138" dst_ip="213.168.67.225" src_port="60217"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22285,1.34206,502,1 0 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_port="22"/>
            <filter dst_ip="1.155.221.198" src_port="52869"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17512,1.3712,503,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.13.103.111" src_port="80"/>
            <filter src_ip="163.222.212.152" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.89475,1.33288,999,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="76.125.249.179" src_port="5353" dst_port="5060"/>
            <filter dst_ip="76.125.249.179" src_port="5353" dst_port="80"/>
            <filter dst_ip="76.125.249.179" src_port="5353" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.61663,1.51078,502,1 1 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="203.13.102.36" dst_ip="213.207.213.86" src_port="53"/>
            <filter src_ip="203.13.98.199" dst_ip="213.207.213.86" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.19192,1.76074,999,1 1 1 1 1 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.13.103.240" dst_ip="206.32.150.254"/>
            <filter src_ip="203.13.103.240" dst_ip="204.255.78.238"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.68083,2.04179,020,1 1 1 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="195.206.146.28" src_port="41454"/>
            <filter src_ip="107.36.230.100"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.88261,1.66292,504,1 1 1 1 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="203.13.106.229" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.68083,2.04179,901,1 1 1 1 1 1 1 0 0 1 1 1,empty">
        <slice/>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.9782,1.69524,010,1 1 1 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="92.3.183.233" src_port="57115"/>
            <filter src_ip="77.116.97.14" src_port="5087" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.72159,1.63147,999,1 1 1 0 0 0 0 0 0 1 1 0,ntscUDPOther">
        <slice>
            <filter src_ip="205.123.218.5" dst_port="5351"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.24608,1.77671,504,1 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter src_ip="162.125.169.160" dst_ip="163.222.112.120" src_port="443"/>
            <filter dst_ip="163.222.112.120"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.24608,1.77671,503,1 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.13.111.172" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.24608,1.77671,504,1 0 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="162.125.227.152" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.15743,1.78192,999,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.13.106.220"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.463,1.40364,504,1 0 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="84.209.20.85"/>
            <filter dst_ip="84.209.20.182"/>
            <filter src_port="80"/>
            <filter src_port="443"/>
            <filter dst_ip="65.116.152.84" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.24608,1.77671,010,1 0 0 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="203.13.106.229" dst_ip="84.209.20.182" src_port="443"/>
            <filter src_ip="203.13.106.229" dst_ip="84.209.20.85" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.7857,4.09099,999,0 0 0 1 1 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.13.108.170" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1585976400"/>
        <to usec="0" sec="1585977228"/>
    </anomaly>
    <anomaly type="anomalous" value="2.75464,2.52121,010,0 0 0 0 0 0 1 1 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="192.137.146.158" dst_port="8008"/>
        </slice>
        <from usec="0" sec="1585976715"/>
        <to usec="0" sec="1585976761"/>
    </anomaly>
    <anomaly type="anomalous" value="2.75464,2.52121,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="146.88.240.68" src_port="1901" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1585977075"/>
        <to usec="0" sec="1585977121"/>
    </anomaly>
    <anomaly type="anomalous" value="1.99449,1.71444,010,1 1 1 0 0 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="45.231.85.132" src_port="7471" dst_port="5100"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.89971,1.68248,999,1 1 1 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.13.110.229"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.15743,1.78192,010,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="185.88.179.4" src_port="52680"/>
            <filter src_ip="195.23.251.144" dst_port="81"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.99449,1.71444,010,1 1 1 0 0 0 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="195.206.146.22" src_port="43026"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.463,1.40364,504,1 0 0 1 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.13.112.244" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="5.0503,4.19692,999,1 0 0 1 1 1 1 1 1 1 0 0,mptmp">
        <slice>
            <filter dst_ip="51.93.70.223" src_port="1194"/>
            <filter dst_ip="43.136.142.161" src_port="1194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.9782,1.69524,999,1 1 1 1 0 0 1 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="103.54.211.166" src_port="5232" dst_port="5060"/>
            <filter src_ip="103.54.211.166" src_port="5312" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.41296,1.87404,504,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.222.103.9" src_port="443"/>
            <filter dst_ip="163.222.100.27" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.24133,1.81212,999,0 0 0 1 1 1 1 0 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.135.10.123" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.15743,1.78192,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.222.9.222" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
