<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="suspicious" value="0.888786,1.16144,999,1 1 0 1 0 0 1 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="51.44.180.13" src_port="5125" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1599627610"/>
        <to usec="0" sec="1599628155"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="91.19.76.105" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1599627667"/>
        <to usec="0" sec="1599628442"/>
    </anomaly>
    <anomaly type="suspicious" value="0.934312,1.12291,502,1 1 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="213.47.30.152" dst_ip="203.70.8.167" dst_port="53"/>
            <filter src_ip="213.47.30.152" dst_ip="203.70.14.237" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,901,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.35.64.188" dst_ip="103.53.217.245" dst_port="443"/>
            <filter src_ip="163.35.64.188" dst_ip="140.143.224.101" dst_port="443"/>
        </slice>
        <from usec="0" sec="1599628020"/>
        <to usec="0" sec="1599628022"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,504,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="207.230.100.229" dst_ip="203.70.0.230" src_port="38723" dst_port="443"/>
            <filter src_ip="207.230.100.229" dst_ip="203.70.0.230" src_port="38412" dst_port="443"/>
        </slice>
        <from usec="0" sec="1599627839"/>
        <to usec="0" sec="1599627843"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,504,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="31.141.119.39" dst_port="443"/>
        </slice>
        <from usec="0" sec="1599628008"/>
        <to usec="0" sec="1599628010"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="103.243.158.240" dst_port="445"/>
        </slice>
        <from usec="0" sec="1599628425"/>
        <to usec="0" sec="1599628427"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="181.199.39.128" dst_port="8291"/>
            <filter src_ip="181.199.39.128" dst_port="22"/>
            <filter src_ip="181.199.39.128" dst_port="8728"/>
        </slice>
        <from usec="0" sec="1599627624"/>
        <to usec="0" sec="1599627634"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="51.55.94.227" src_port="4040" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1599628427"/>
        <to usec="0" sec="1599628428"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="80.193.83.208" dst_port="1433"/>
            <filter src_ip="80.193.83.208" dst_port="445"/>
        </slice>
        <from usec="0" sec="1599627895"/>
        <to usec="0" sec="1599627899"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="103.44.243.157" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628114"/>
        <to usec="0" sec="1599628118"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="59.46.160.131" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628398"/>
        <to usec="0" sec="1599628411"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="182.168.219.132" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628464"/>
        <to usec="0" sec="1599628466"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="106.203.64.140" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627999"/>
        <to usec="0" sec="1599628003"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="118.248.82.140" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628076"/>
        <to usec="0" sec="1599628077"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="110.73.106.244" dst_port="8291"/>
            <filter src_ip="110.73.106.244" dst_port="8728"/>
            <filter src_ip="110.73.106.244" dst_port="22"/>
        </slice>
        <from usec="0" sec="1599628107"/>
        <to usec="0" sec="1599628117"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="13.223.61.48" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1599627766"/>
        <to usec="0" sec="1599628110"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="150.60.71.35" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627841"/>
        <to usec="0" sec="1599627843"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.6.87.28" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628060"/>
        <to usec="0" sec="1599628062"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="170.124.69.144" dst_port="8291"/>
            <filter src_ip="170.124.69.144" dst_port="8728"/>
            <filter src_ip="170.124.69.144" dst_port="22"/>
        </slice>
        <from usec="0" sec="1599628461"/>
        <to usec="0" sec="1599628471"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="82.223.92.35" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627914"/>
        <to usec="0" sec="1599627919"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="122.3.244.221" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627614"/>
        <to usec="0" sec="1599627615"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="49.69.43.91" dst_port="8291"/>
        </slice>
        <from usec="0" sec="1599628168"/>
        <to usec="0" sec="1599628179"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="221.243.219.39" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627643"/>
        <to usec="0" sec="1599627647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="122.117.29.64" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628333"/>
        <to usec="0" sec="1599628335"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="109.237.136.52" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627718"/>
        <to usec="0" sec="1599627720"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="223.181.189.39" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628190"/>
        <to usec="0" sec="1599628192"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="123.82.41.140" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627879"/>
        <to usec="0" sec="1599627881"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="183.238.201.19" dst_port="445"/>
        </slice>
        <from usec="0" sec="1599627857"/>
        <to usec="0" sec="1599627863"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="27.159.71.33" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628244"/>
        <to usec="0" sec="1599628248"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.95.166.254" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628424"/>
        <to usec="0" sec="1599628427"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.66.14.153" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627647"/>
        <to usec="0" sec="1599627651"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="124.148.202.240" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627768"/>
        <to usec="0" sec="1599627778"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.222.88.156" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628451"/>
        <to usec="0" sec="1599628453"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="120.59.65.248" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627682"/>
        <to usec="0" sec="1599627684"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="218.190.78.163" dst_port="445"/>
        </slice>
        <from usec="0" sec="1599627641"/>
        <to usec="0" sec="1599627643"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="202.126.81.106" dst_port="8291"/>
            <filter src_ip="202.126.81.106" dst_port="8728"/>
            <filter src_ip="202.126.81.106" dst_port="22"/>
        </slice>
        <from usec="0" sec="1599628204"/>
        <to usec="0" sec="1599628214"/>
    </anomaly>
    <anomaly type="suspicious" value="0.912064,1.18952,010,1 1 1 1 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="125.113.93.46" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627735"/>
        <to usec="0" sec="1599627738"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.206.207.16" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628227"/>
        <to usec="0" sec="1599628229"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="59.39.202.125" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627605"/>
        <to usec="0" sec="1599627609"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="59.85.112.136" dst_port="8291"/>
            <filter src_ip="59.85.112.136" dst_port="8728"/>
            <filter src_ip="59.85.112.136" dst_port="22"/>
        </slice>
        <from usec="0" sec="1599627841"/>
        <to usec="0" sec="1599627851"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.197.159.198" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627836"/>
        <to usec="0" sec="1599627838"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.134.215.128" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628045"/>
        <to usec="0" sec="1599628046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="117.50.227.124" dst_port="445"/>
        </slice>
        <from usec="0" sec="1599627617"/>
        <to usec="0" sec="1599628286"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.227.205.143" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628338"/>
        <to usec="0" sec="1599628339"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="170.176.65.112" dst_port="8291"/>
            <filter src_ip="170.176.65.112" dst_port="8728"/>
            <filter src_ip="170.176.65.112" dst_port="22"/>
        </slice>
        <from usec="0" sec="1599628359"/>
        <to usec="0" sec="1599628371"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="203.10.126.99" dst_port="8291"/>
            <filter src_ip="203.10.126.99" dst_port="22"/>
        </slice>
        <from usec="0" sec="1599628040"/>
        <to usec="0" sec="1599628048"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="203.70.19.157" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628400"/>
        <to usec="0" sec="1599628401"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="79.95.99.137" dst_port="445"/>
            <filter src_ip="79.95.99.137" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628185"/>
        <to usec="0" sec="1599628191"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.175.253.161" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628408"/>
        <to usec="0" sec="1599628409"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="103.10.198.92" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627839"/>
        <to usec="0" sec="1599627845"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="163.64.19.93" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627696"/>
        <to usec="0" sec="1599627698"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.77.62.83" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628089"/>
        <to usec="0" sec="1599628091"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="112.130.12.81" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627903"/>
        <to usec="0" sec="1599627907"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="185.241.14.64" dst_port="1433"/>
            <filter src_ip="185.241.14.64" dst_port="445"/>
        </slice>
        <from usec="0" sec="1599628336"/>
        <to usec="0" sec="1599628340"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="183.124.146.31" dst_port="445"/>
        </slice>
        <from usec="0" sec="1599628128"/>
        <to usec="0" sec="1599628131"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="14.202.67.220" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627757"/>
        <to usec="0" sec="1599627759"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="219.107.17.231" dst_port="445"/>
            <filter src_ip="219.107.17.231" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628324"/>
        <to usec="0" sec="1599628327"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.78.87.45" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628087"/>
        <to usec="0" sec="1599628092"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="36.70.174.9" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628247"/>
        <to usec="0" sec="1599628248"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="118.241.79.219" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627999"/>
        <to usec="0" sec="1599628011"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="105.23.130.33" dst_port="8291"/>
        </slice>
        <from usec="0" sec="1599627781"/>
        <to usec="0" sec="1599627785"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="27.179.56.16" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628417"/>
        <to usec="0" sec="1599628422"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="188.227.114.43" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1599628112"/>
        <to usec="0" sec="1599628301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="5.240.78.21" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628411"/>
        <to usec="0" sec="1599628413"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="106.195.18.43" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628216"/>
        <to usec="0" sec="1599628218"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="122.60.11.234" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627612"/>
        <to usec="0" sec="1599627614"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.22.230.55" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1599627999"/>
        <to usec="0" sec="1599628062"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="60.114.113.203" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627953"/>
        <to usec="0" sec="1599627955"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="64.200.43.247" dst_port="1433"/>
            <filter src_ip="64.200.43.247" dst_port="445"/>
        </slice>
        <from usec="0" sec="1599627841"/>
        <to usec="0" sec="1599627844"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.59.148.57" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628393"/>
        <to usec="0" sec="1599628394"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.238.82.13" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628351"/>
        <to usec="0" sec="1599628353"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="125.49.90.11" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627656"/>
        <to usec="0" sec="1599627657"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.231.3.243" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599627739"/>
        <to usec="0" sec="1599627741"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="110.161.78.196" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1599628166"/>
        <to usec="0" sec="1599628168"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="182.172.134.79"/>
        </slice>
        <from usec="0" sec="1599628178"/>
        <to usec="0" sec="1599628179"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,504,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="203.70.19.157" dst_port="443"/>
        </slice>
        <from usec="0" sec="1599628018"/>
        <to usec="0" sec="1599628211"/>
    </anomaly>
    <anomaly type="suspicious" value="0.912064,1.18952,999,1 1 1 1 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="89.6.212.6" dst_port="1031"/>
        </slice>
        <from usec="0" sec="1599627600"/>
        <to usec="0" sec="1599628156"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0103,1.21029,999,1 1 1 1 0 0 1 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="89.6.212.6" dst_port="1031"/>
        </slice>
        <from usec="0" sec="1599627600"/>
        <to usec="0" sec="1599628338"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05057,1.17337,999,1 1 1 0 0 0 0 0 0 1 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="80.221.82.54" dst_port="6144"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.775305,1.13978,999,1 1 0 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="67.128.181.212" dst_ip="202.198.233.122"/>
            <filter src_ip="67.128.181.212" dst_port="53"/>
            <filter dst_ip="202.198.233.122" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599627600"/>
        <to usec="0" sec="1599628158"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28322,1.35586,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1599627600"/>
        <to usec="0" sec="1599628338"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28322,1.35586,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1599627600"/>
        <to usec="0" sec="1599628338"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28322,1.35586,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1599627600"/>
        <to usec="0" sec="1599628338"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28322,1.35586,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1599627600"/>
        <to usec="0" sec="1599628338"/>
    </anomaly>
    <anomaly type="suspicious" value="0.787149,1.14549,010,0 0 0 1 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="89.6.222.54" src_port="47582" dst_port="5902"/>
        </slice>
        <from usec="0" sec="1599627600"/>
        <to usec="0" sec="1599627787"/>
    </anomaly>
    <anomaly type="suspicious" value="1.26516,1.34004,502,1 1 1 1 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="218.172.251.46" src_port="22"/>
        </slice>
        <from usec="0" sec="1599627600"/>
        <to usec="0" sec="1599628446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0189,1.26331,999,1 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.70.6.169" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599628176"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.35.103.149" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,DDoSUDP">
        <slice>
            <filter dst_ip="38.102.230.239" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.35.97.21" src_port="443"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.35.105.21" src_port="443"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="73.216.100.202" dst_ip="203.70.6.250" dst_port="1194"/>
            <filter src_ip="47.234.18.100" dst_ip="203.70.6.250" dst_port="1194"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.2.63.69" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0189,1.26331,504,1 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="52.56.118.242" dst_ip="163.35.246.182" src_port="443"/>
        </slice>
        <from usec="0" sec="1599627768"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.70.8.187" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.2.63.5" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822951,1.18805,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.35.35.108" src_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822951,1.18805,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.35.35.106" src_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="73.216.100.202" dst_ip="203.70.4.210" dst_port="1194"/>
            <filter src_ip="47.234.18.100" dst_ip="203.70.4.210" dst_port="1194"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,011,0 0 0 0 0 0 1 1 1 0 0 0,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="45.32.87.53" src_port="52869"/>
            <filter dst_ip="45.32.87.53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,malphfl">
        <slice>
            <filter src_ip="185.79.171.27" dst_ip="31.141.119.30" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822951,1.18805,504,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.35.157.81" src_port="443"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822951,1.18805,010,0 0 0 0 0 0 1 1 0 0 0 0,poscaSYN">
        <slice>
            <filter src_ip="134.222.122.192" dst_ip="203.70.29.106" src_port="32766"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICecrqICecrqdurmterp">
        <slice>
            <filter dst_ip="203.70.15.70"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16308,1.18199,504,1 0 0 1 0 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="163.35.66.135" src_port="443"/>
            <filter src_ip="75.130.99.186" dst_ip="163.35.66.229" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="193.170.13.68" src_port="25"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822951,1.18805,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="202.198.201.76" dst_ip="163.35.65.99" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,011,0 0 0 0 0 0 1 1 1 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="64.228.199.131" src_port="80"/>
        </slice>
        <from usec="0" sec="1599627600"/>
        <to usec="0" sec="1599628141"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.70.14.157" src_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,504,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="163.35.27.22" dst_ip="13.23.54.97" dst_port="443"/>
            <filter src_ip="202.203.35.219" dst_ip="13.23.54.97" dst_port="443"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822951,1.18805,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="116.166.146.90" dst_ip="133.2.231.164"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.35.164.177" src_port="443"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,502,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="112.107.42.68" src_port="22"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822951,1.18805,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.2.61.181" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,010,0 0 0 0 0 0 1 1 1 0 0 0,poscaSYN">
        <slice>
            <filter src_ip="46.164.63.31" dst_ip="163.35.117.191" src_port="32766"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,010,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.2.61.198" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="133.138.53.119" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="202.198.201.76" dst_ip="13.55.8.14" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.1884,1.33119,504,1 1 1 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="202.203.35.61" dst_port="443"/>
            <filter dst_ip="40.160.90.18" dst_port="443"/>
        </slice>
        <from usec="0" sec="1599627614"/>
        <to usec="0" sec="1599628500"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,504,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="13.46.147.10" dst_ip="163.35.186.37" src_port="443"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,010,0 0 0 0 0 0 1 1 1 0 0 0,poscaSYN">
        <slice>
            <filter src_ip="139.55.243.195" dst_ip="203.70.13.193" src_port="32766"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599627826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.26516,1.34004,504,1 1 1 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_ip="162.195.33.132" dst_port="443"/>
            <filter dst_ip="52.116.121.246" dst_port="443"/>
        </slice>
        <from usec="0" sec="1599627602"/>
        <to usec="0" sec="1599628500"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.70.8.162" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="133.138.229.126" src_port="53"/>
            <filter dst_ip="133.138.229.126" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822951,1.18805,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.54.227.158" dst_ip="13.55.199.108" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.35.97.23" src_port="443"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822951,1.18805,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.198.224.31" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.08698,1.28694,999,1 1 0 0 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="89.6.212.208"/>
            <filter src_ip="45.157.122.83"/>
        </slice>
        <from usec="0" sec="1599627604"/>
        <to usec="0" sec="1599628491"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.70.8.189" src_port="53"/>
            <filter dst_ip="203.70.8.189" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="125.120.111.74" dst_ip="203.70.4.200" src_port="53"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822951,1.18805,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.70.2.45" src_port="53"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822951,1.18805,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="38.102.230.239" dst_ip="163.35.34.228" src_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.35.35.98" src_port="53"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="38.102.230.239" dst_ip="163.35.34.229" src_port="53"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.35.155.62" src_port="443"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.35.35.100" src_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="38.102.230.239" dst_ip="163.35.34.227" src_port="53"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.35.35.101" src_port="53"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822951,1.18805,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.35.35.103" src_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.35.34.224" src_port="53"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09523,1.28181,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.35.35.95" src_port="53"/>
        </slice>
        <from usec="0" sec="1599627600"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.35.34.223" src_port="53"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.35.35.94" src_port="53"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.35.35.92" src_port="53"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822951,1.18805,504,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="76.4.21.38" dst_port="443"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="193.170.13.68" src_port="25"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="203.70.8.189" dst_ip="216.20.184.130" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,504,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.35.64.200" dst_ip="180.23.3.131" dst_port="443"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="203.70.8.189" dst_ip="216.20.184.133" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.70.8.189" dst_ip="69.28.128.114" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="0.822951,1.18805,999,0 0 0 0 0 0 1 1 0 0 0 0,DDoSUDP">
        <slice>
            <filter dst_ip="163.35.209.180"/>
        </slice>
        <from usec="0" sec="1599627780"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.70.13.252" dst_port="53"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.35.155.213" src_port="443"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,504,0 0 0 0 0 0 1 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.35.229.201" src_port="443"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="45.143.252.242"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00558,1.27256,010,0 0 0 0 0 0 1 1 1 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="133.2.198.3" src_port="80"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="0.906834,1.25283,999,0 0 0 0 0 0 0 1 1 0 0 0,mptpla">
        <slice>
            <filter dst_ip="133.2.235.251" dst_port="36715"/>
            <filter dst_ip="133.2.235.251" dst_port="36714"/>
            <filter dst_ip="133.2.235.251" dst_port="9993"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="0.906834,1.25283,999,0 0 0 0 0 0 0 1 1 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="38.102.230.239" dst_ip="163.35.34.222" src_port="53"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="0.906834,1.25283,504,0 0 0 0 0 0 0 1 1 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.35.245.66" src_port="443"/>
        </slice>
        <from usec="0" sec="1599628050"/>
        <to usec="0" sec="1599628096"/>
    </anomaly>
    <anomaly type="suspicious" value="0.838215,1.1064,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="104.211.64.224" src_port="55105" dst_port="22000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.854153,1.09575,504,1 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="216.182.216.176" dst_ip="163.35.66.158" src_port="443"/>
            <filter src_ip="216.182.216.176" dst_ip="163.35.155.89" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.838215,1.1064,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="221.205.165.253"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.838215,1.1064,504,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.35.232.19" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.838215,1.1064,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="202.231.249.63"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22407,1.25754,999,1 0 0 0 0 0 1 1 1 1 0 0,mptpla">
        <slice>
            <filter src_ip="203.70.4.210" dst_ip="47.234.18.100" src_port="1194"/>
            <filter src_ip="203.70.6.250" dst_ip="47.234.18.100" src_port="1194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.838215,1.1064,010,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="74.40.208.83" src_port="21" dst_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.802195,1.17954,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="164.251.135.87" dst_port="445"/>
        </slice>
        <from usec="0" sec="1599627869"/>
        <to usec="0" sec="1599627874"/>
    </anomaly>
    <anomaly type="anomalous" value="1.58574,1.25461,004,1 1 1 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.105.117.119" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.29645,1.18054,999,1 1 1 0 0 0 0 0 0 1 1 0,ntscUDPOther">
        <slice>
            <filter src_ip="178.221.192.65" src_port="5067" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.58574,1.25461,999,1 1 1 0 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.70.9.15" dst_ip="206.19.91.5"/>
            <filter src_ip="203.70.9.15" dst_ip="204.93.150.33"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.38752,1.68728,010,1 1 1 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="193.100.27.121" src_port="54286"/>
            <filter src_ip="51.37.245.185" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.34764,1.67244,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="163.35.61.78" src_port="9090" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.58574,1.25461,999,1 1 1 0 0 0 0 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="89.6.220.121" dst_port="28015"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.82437,1.38499,999,1 0 1 1 0 0 1 1 1 1 1 1,alphfl">
        <slice>
            <filter src_ip="213.184.228.138" dst_ip="163.35.102.236" dst_port="6574"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.34764,1.67244,503,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.70.4.223" src_port="80"/>
            <filter src_ip="203.70.9.171" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.79275,1.37333,999,0 1 0 1 0 0 1 1 1 1 1 1,alphfl">
        <slice>
            <filter src_ip="213.184.228.138" dst_ip="202.198.230.12" dst_port="6549"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.06797,1.56972,503,0 0 0 1 1 1 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="202.203.35.219" dst_ip="38.102.230.208" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.34764,1.67244,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="85.224.252.103" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.75231,1.35122,504,0 0 0 1 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.35.64.136" src_port="443"/>
            <filter dst_ip="163.35.154.163" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.2606,1.62616,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.35.240.200"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.43023,1.73254,504,1 0 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.35.151.232" src_port="443"/>
            <filter dst_ip="163.35.72.193" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.70051,1.28356,999,1 1 1 1 0 0 1 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="165.97.36.176" dst_port="53413"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.34764,1.67244,504,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="13.45.212.176" src_port="443"/>
            <filter dst_ip="163.35.172.161" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.38752,1.68728,999,1 1 1 1 1 1 1 0 0 1 1 1,ntscUDPDNS">
        <slice>
            <filter src_ip="54.39.216.166" src_port="43607" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.14309,1.10343,504,1 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.70.0.199"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.50459,1.27356,020,1 0 0 1 0 0 1 1 1 1 1 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="80.221.82.23"/>
            <filter dst_ip="45.154.233.29"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.45378,1.19222,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="203.70.0.199" src_port="38973"/>
            <filter src_ip="203.70.0.199" src_port="37587"/>
            <filter src_ip="203.70.0.199" src_port="3010"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.13123,1.11401,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="203.70.0.212"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.13123,1.11401,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="104.105.142.91" dst_ip="163.35.251.44" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.45378,1.19222,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.35.211.65" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.45378,1.19222,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.35.154.220" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.43023,1.73254,504,1 0 0 1 1 1 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.70.19.157" src_port="53"/>
            <filter dst_ip="203.70.19.157" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.45378,1.19222,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="133.24.216.232" src_port="27032" dst_port="27032"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.36053,1.67145,504,1 0 0 1 1 1 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="13.55.148.241" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.43849,1.72333,503,1 1 1 1 1 1 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.70.4.223" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5867,1.21302,504,1 0 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.35.154.206" src_port="443"/>
            <filter dst_ip="163.35.235.101" src_port="443"/>
            <filter dst_ip="163.35.244.88" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.45378,1.19222,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="184.111.46.191" dst_ip="163.35.238.73" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.14309,1.10343,503,1 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.35.154.184" src_port="443"/>
            <filter dst_ip="163.35.154.184" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.13123,1.11401,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.203.38.231" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.49559,1.28273,504,0 0 0 1 0 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter dst_ip="163.35.96.154" src_port="443"/>
            <filter dst_ip="203.70.15.39" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.2606,1.62616,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="23.71.23.210" dst_ip="163.35.220.188"/>
            <filter dst_ip="163.35.155.151" src_port="80"/>
            <filter dst_ip="163.35.220.188" src_port="443"/>
            <filter src_ip="23.71.23.210" dst_ip="163.35.155.151" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.51717,1.2021,504,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.35.155.115"/>
            <filter src_ip="31.141.119.27" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.2606,1.62616,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="23.194.46.233" src_port="80"/>
            <filter dst_ip="163.35.66.214" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.06797,1.56972,504,0 0 0 1 1 1 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="23.76.201.171" src_port="443"/>
            <filter src_ip="23.76.201.171" src_port="80"/>
            <filter dst_ip="163.35.240.181" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.45378,1.19222,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="23.83.173.243" dst_ip="163.35.238.103" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.2606,1.62616,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="38.102.230.217" src_port="80"/>
            <filter dst_ip="163.35.154.236" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.74716,1.35607,999,1 1 0 0 0 0 1 1 1 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="202.198.201.76" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.13123,1.11401,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="52.235.174.114" dst_ip="163.35.67.79" src_port="80" dst_port="52521"/>
            <filter src_ip="52.235.174.114" dst_ip="163.35.67.79" src_port="80" dst_port="52518"/>
            <filter src_ip="52.235.174.114" dst_ip="163.35.67.79" src_port="80" dst_port="52516"/>
            <filter src_ip="52.235.174.114" dst_ip="163.35.67.79" src_port="443" dst_port="52519"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.80025,1.36476,504,1 1 0 1 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="1.252.230.129" dst_ip="163.35.155.63"/>
            <filter src_ip="1.252.230.129" src_port="53"/>
            <filter dst_ip="203.70.14.218" src_port="53"/>
            <filter dst_ip="203.70.14.218" src_port="443"/>
            <filter dst_ip="163.35.155.63" src_port="53"/>
            <filter dst_ip="163.35.155.63" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.30198,1.64141,504,0 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.35.220.182"/>
            <filter dst_ip="163.35.174.204" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.58574,1.25461,010,1 1 1 0 0 0 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="201.183.84.115" dst_port="8291"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.2606,1.62616,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="17.18.180.20" src_port="80"/>
            <filter src_ip="17.18.180.20" src_port="443"/>
            <filter dst_ip="163.35.154.136" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.2606,1.62616,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.35.124.201" src_port="443"/>
            <filter dst_ip="163.35.240.12" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.50459,1.27356,999,1 0 0 1 0 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter src_ip="203.70.4.210" dst_ip="181.33.181.135"/>
            <filter src_ip="203.70.6.250" dst_ip="181.33.181.135"/>
            <filter dst_ip="181.33.181.135" src_port="1194"/>
            <filter src_ip="203.70.4.210" dst_ip="73.216.100.202" src_port="1194"/>
            <filter src_ip="203.70.6.250" dst_ip="73.216.100.202" src_port="1194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.62416,1.34092,503,1 1 1 1 0 0 1 1 1 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.70.9.171" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.29645,1.18054,504,1 1 1 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.105.117.119" src_port="445"/>
            <filter src_ip="202.105.117.119" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
