<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="anomalous" value="1.95673,1.32958,999,1 1 1 1 1 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.77.49.75" dst_ip="206.92.228.254"/>
            <filter src_ip="203.77.49.75" dst_ip="204.193.62.26"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.28299,1.11237,010,1 1 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.77.54.78" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.81881,1.24858,503,1 1 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.77.48.251" dst_port="53"/>
            <filter dst_ip="203.77.49.144" dst_port="80"/>
            <filter dst_ip="203.77.59.172" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.81339,1.32948,999,1 1 1 0 0 0 0 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="51.97.192.52" src_port="4059" dst_port="5085"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78791,1.28542,999,1 1 1 1 0 0 0 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="51.255.50.251" src_port="4040" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.49177,1.23972,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.221.196.121"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.22465,1.09346,010,1 1 0 1 1 0 0 0 0 1 0 0,DDoSSYNACKrp">
        <slice>
            <filter src_ip="133.247.11.85" src_port="21"/>
            <filter src_ip="133.247.11.67" src_port="21"/>
            <filter src_ip="133.247.11.112" src_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.47942,1.78842,010,1 1 1 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="192.9.26.226" src_port="43210"/>
            <filter src_ip="45.228.182.114" src_port="8080"/>
            <filter src_ip="45.255.55.30" src_port="42406"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.18335,1.63903,504,0 0 0 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="133.228.71.50" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.9093,1.53789,999,0 0 0 1 1 1 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="147.132.154.240" dst_ip="203.77.59.181" dst_port="53"/>
            <filter src_ip="147.132.154.240" dst_ip="203.77.59.179" dst_port="53"/>
            <filter src_ip="147.132.154.240" dst_ip="203.77.48.251" dst_port="53"/>
            <filter src_ip="147.132.154.240" dst_ip="203.77.48.224" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.95673,1.32958,010,1 1 1 1 1 0 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="206.34.159.3" dst_port="52869"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.18335,1.63903,504,0 0 0 1 1 1 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="133.228.94.233" dst_ip="54.155.114.154" src_port="52376" dst_port="443"/>
            <filter src_ip="133.228.94.233" dst_ip="54.155.114.154" src_port="52374" dst_port="443"/>
            <filter src_ip="133.228.94.233" dst_ip="54.155.114.154" src_port="52342" dst_port="443"/>
            <filter src_ip="133.228.94.233" dst_ip="54.80.201.0" src_port="34888" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.47942,1.78842,010,1 1 1 1 1 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="167.193.36.152" src_port="18841" dst_port="28"/>
            <filter src_ip="167.193.36.152" src_port="31756" dst_port="6000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.83849,2.0573,010,1 1 1 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="45.228.182.188" src_port="8080"/>
            <filter src_ip="193.205.0.221" dst_port="5063"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.74523,2.00591,010,1 1 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="193.228.27.175" src_port="54615"/>
            <filter src_ip="139.36.130.33" src_port="52986" dst_port="33"/>
            <filter src_ip="167.193.228.108" src_port="52315" dst_port="2729"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.39547,1.67387,999,1 1 1 1 1 1 0 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="216.109.172.217" src_port="45061" dst_port="5060"/>
            <filter src_ip="216.109.172.217" src_port="54306" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.2842,1.61028,503,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.77.49.144" src_port="80"/>
            <filter src_ip="203.77.59.172" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.24186,1.69621,010,1 1 1 1 1 0 1 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="39.186.225.231" dst_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.34848,1.75584,010,1 1 1 1 0 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="218.77.232.152" src_port="6564" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.73228,1.63548,999,1 1 0 0 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="51.151.20.75" dst_ip="203.77.56.170" dst_port="53"/>
            <filter src_ip="51.151.20.75" dst_ip="203.77.56.169" dst_port="53"/>
        </slice>
        <from usec="0" sec="1617512542"/>
        <to usec="0" sec="1617513295"/>
    </anomaly>
    <anomaly type="anomalous" value="1.31756,1.15372,504,0 0 0 1 1 0 0 0 0 1 1 0,heavy_hitter">
        <slice>
            <filter src_ip="54.80.248.233" dst_ip="163.221.24.183" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.1736,1.08963,504,0 1 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.221.184.36" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.22351,1.61904,504,1 0 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="163.221.239.238" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.1317,1.07259,999,1 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="203.77.58.46" dst_ip="4.29.202.30"/>
            <filter src_ip="203.77.58.46" src_port="53"/>
            <filter src_ip="203.77.58.46" dst_port="53"/>
            <filter dst_ip="4.29.202.30" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.66363,1.24847,999,1 1 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="203.77.49.75" src_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.18335,1.63903,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.221.223.137" src_port="443"/>
            <filter dst_ip="163.221.120.253" src_port="443"/>
            <filter dst_ip="163.221.121.219" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.9551,1.51657,504,1 0 0 1 1 1 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.221.148.250" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.39547,1.67387,504,1 1 1 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="202.207.223.246" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.18335,1.63903,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.221.239.238" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.12254,1.63349,010,1 1 0 1 1 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="203.77.56.172" src_port="32766"/>
            <filter dst_ip="203.77.55.46" src_port="32766"/>
            <filter src_ip="217.0.172.113" dst_ip="203.77.56.172" src_port="52934"/>
            <filter src_ip="5.50.183.204" dst_ip="203.77.55.46" src_port="52778"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.24186,1.69621,999,1 1 1 1 1 0 1 0 0 1 1 0,ptpposcaUDP">
        <slice>
            <filter src_ip="71.6.144.90" dst_ip="71.200.127.144" src_port="389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.83849,2.0573,999,1 1 1 1 1 1 1 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="203.77.56.255" dst_ip="3.68.172.31" src_port="1194"/>
            <filter src_ip="203.77.59.165" dst_ip="3.68.172.31" src_port="1194"/>
            <filter src_ip="133.228.247.125" dst_ip="3.68.172.31" src_port="1194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.81881,1.24858,504,1 1 0 1 1 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="163.221.52.161" dst_ip="54.63.56.192" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.74523,2.00591,999,1 1 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.77.55.46"/>
            <filter src_ip="203.77.56.172"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.81881,1.24858,010,1 1 0 1 1 0 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="139.36.130.33" src_port="52986" dst_port="33"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.52222,1.28534,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.221.196.190" src_port="443"/>
            <filter src_ip="31.241.179.53" dst_ip="163.221.245.46" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.52222,1.28534,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="54.147.105.78" dst_ip="163.221.128.207" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.49177,1.23972,504,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="202.207.223.45" src_port="443"/>
            <filter src_ip="202.207.217.145" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.18335,1.63903,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.77.33.172" src_port="443"/>
            <filter dst_ip="203.77.33.172"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.52222,1.28534,999,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="133.228.95.109" dst_ip="206.95.84.109" src_port="61001" dst_port="8080"/>
            <filter src_ip="133.228.95.109" dst_ip="206.95.84.109" src_port="60996" dst_port="8080"/>
            <filter src_ip="133.228.95.109" dst_ip="206.95.84.109" src_port="60529" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,999,1 1 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="203.77.56.170" dst_ip="51.151.20.75" src_port="53"/>
            <filter src_ip="203.77.56.169" dst_ip="51.151.20.75" src_port="53"/>
        </slice>
        <from usec="0" sec="1617512409"/>
        <to usec="0" sec="1617513300"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,504,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="126.228.166.66" dst_ip="203.77.54.22" src_port="50058" dst_port="443"/>
        </slice>
        <from usec="0" sec="1617512457"/>
        <to usec="0" sec="1617513295"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="203.77.62.180" dst_ip="97.114.90.233" src_port="53"/>
        </slice>
        <from usec="0" sec="1617512715"/>
        <to usec="0" sec="1617513259"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="216.172.225.12" dst_ip="203.77.58.152" dst_port="53"/>
            <filter src_ip="216.172.225.12" dst_ip="203.77.58.46" dst_port="53"/>
            <filter src_ip="216.172.225.12" dst_ip="203.77.58.145" dst_port="53"/>
            <filter src_ip="216.172.225.12" dst_ip="203.77.58.148" dst_port="53"/>
        </slice>
        <from usec="0" sec="1617512953"/>
        <to usec="0" sec="1617512958"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="203.77.54.54" dst_ip="13.74.211.65" src_port="80" dst_port="47104"/>
        </slice>
        <from usec="0" sec="1617512482"/>
        <to usec="0" sec="1617512487"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="23.113.234.25" dst_ip="203.77.50.84" src_port="80" dst_port="52623"/>
            <filter src_ip="23.113.234.25" dst_ip="203.77.50.84" src_port="80" dst_port="52550"/>
            <filter src_ip="23.113.234.25" dst_ip="203.77.50.84" src_port="80" dst_port="51148"/>
        </slice>
        <from usec="0" sec="1617512409"/>
        <to usec="0" sec="1617513269"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768317,1.06252,502,1 1 0 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="61.206.81.117" src_port="22"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617513298"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="99.172.150.88" dst_ip="203.77.54.158" src_port="80"/>
        </slice>
        <from usec="0" sec="1617512473"/>
        <to usec="0" sec="1617512474"/>
    </anomaly>
    <anomaly type="suspicious" value="1.10566,1.11554,999,1 1 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.199.12.7" dst_port="53"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617512944"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="167.193.36.152" src_port="28" dst_port="18841"/>
        </slice>
        <from usec="0" sec="1617512912"/>
        <to usec="0" sec="1617512913"/>
    </anomaly>
    <anomaly type="suspicious" value="0.979475,1.09333,504,1 1 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.221.208.202" src_port="443"/>
            <filter src_ip="34.81.254.164" dst_ip="163.221.208.202" src_port="9930"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="46.230.30.234" src_port="5580" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1617512534"/>
        <to usec="0" sec="1617513153"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="91.162.119.197" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1617512621"/>
        <to usec="0" sec="1617512923"/>
    </anomaly>
    <anomaly type="suspicious" value="0.768317,1.06252,999,1 1 0 1 0 0 0 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.221.31.98" src_port="53"/>
            <filter dst_ip="163.221.30.223" src_port="53"/>
            <filter dst_ip="163.221.30.237" src_port="53"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617513207"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.195.101.23" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512685"/>
        <to usec="0" sec="1617512687"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.9.221.120" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617513019"/>
        <to usec="0" sec="1617513024"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="103.169.158.133" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617513178"/>
        <to usec="0" sec="1617513179"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="115.76.110.149" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512526"/>
        <to usec="0" sec="1617512528"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="122.59.76.110" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512727"/>
        <to usec="0" sec="1617512729"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="178.160.248.40" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512776"/>
        <to usec="0" sec="1617512780"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="202.51.175.21" dst_port="8291"/>
            <filter src_ip="202.51.175.21" dst_port="22"/>
        </slice>
        <from usec="0" sec="1617513240"/>
        <to usec="0" sec="1617513293"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.131.190.169" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512631"/>
        <to usec="0" sec="1617512632"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="157.201.13.113" dst_port="445"/>
        </slice>
        <from usec="0" sec="1617513246"/>
        <to usec="0" sec="1617513248"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.209.64.70" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1617512933"/>
        <to usec="0" sec="1617513105"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="90.243.195.43" dst_port="445"/>
        </slice>
        <from usec="0" sec="1617513127"/>
        <to usec="0" sec="1617513217"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="122.32.252.227" dst_port="1433"/>
            <filter src_ip="122.32.252.227" dst_port="445"/>
        </slice>
        <from usec="0" sec="1617513076"/>
        <to usec="0" sec="1617513082"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="217.155.130.185" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512609"/>
        <to usec="0" sec="1617512611"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.189.168.220" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512834"/>
        <to usec="0" sec="1617512835"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="2.174.25.52" dst_port="445"/>
        </slice>
        <from usec="0" sec="1617513023"/>
        <to usec="0" sec="1617513029"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.252.98.179" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512716"/>
        <to usec="0" sec="1617512718"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="123.244.250.166" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512922"/>
        <to usec="0" sec="1617512926"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="60.76.33.67" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617513178"/>
        <to usec="0" sec="1617513181"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="190.59.103.155" dst_port="445"/>
        </slice>
        <from usec="0" sec="1617513074"/>
        <to usec="0" sec="1617513077"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.87.231.241" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617513281"/>
        <to usec="0" sec="1617513284"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="51.193.155.123" dst_port="445"/>
        </slice>
        <from usec="0" sec="1617513035"/>
        <to usec="0" sec="1617513038"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="202.96.103.2" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617513073"/>
        <to usec="0" sec="1617513074"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.9.45.154" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617513121"/>
        <to usec="0" sec="1617513125"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.208.232.151" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512441"/>
        <to usec="0" sec="1617512445"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="190.104.40.107" dst_port="1433"/>
            <filter src_ip="190.104.40.107" dst_port="445"/>
        </slice>
        <from usec="0" sec="1617512531"/>
        <to usec="0" sec="1617512537"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="203.77.56.172" dst_port="445"/>
        </slice>
        <from usec="0" sec="1617512578"/>
        <to usec="0" sec="1617512581"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="164.187.26.88" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512500"/>
        <to usec="0" sec="1617512501"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="164.187.26.93" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512500"/>
        <to usec="0" sec="1617512501"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.74.141.172" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512770"/>
        <to usec="0" sec="1617512781"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.101.13.163" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512988"/>
        <to usec="0" sec="1617512992"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.246.101.155" dst_port="445"/>
        </slice>
        <from usec="0" sec="1617512738"/>
        <to usec="0" sec="1617512740"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="212.22.77.168" dst_port="445"/>
        </slice>
        <from usec="0" sec="1617513262"/>
        <to usec="0" sec="1617513265"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="103.186.12.79" dst_port="445"/>
            <filter src_ip="103.186.12.79" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512870"/>
        <to usec="0" sec="1617512874"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="95.198.8.122" dst_port="1433"/>
            <filter src_ip="95.198.8.122" dst_port="445"/>
        </slice>
        <from usec="0" sec="1617512530"/>
        <to usec="0" sec="1617512537"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.0.142.43" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512758"/>
        <to usec="0" sec="1617512759"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.211.97.222" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512717"/>
        <to usec="0" sec="1617512719"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="144.160.56.210" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617513198"/>
        <to usec="0" sec="1617513200"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.62.94.17" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512487"/>
        <to usec="0" sec="1617512491"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="121.31.8.27" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617512492"/>
        <to usec="0" sec="1617512499"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,010,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="103.197.131.234" dst_port="445"/>
        </slice>
        <from usec="0" sec="1617512972"/>
        <to usec="0" sec="1617512973"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="103.99.242.24" dst_port="445"/>
        </slice>
        <from usec="0" sec="1617513121"/>
        <to usec="0" sec="1617513122"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="106.47.231.225" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1617513203"/>
        <to usec="0" sec="1617513205"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.230.62.15" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1617512672"/>
        <to usec="0" sec="1617513228"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.230.62.11" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1617512728"/>
        <to usec="0" sec="1617512956"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05406,1.15662,010,1 1 1 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="193.228.26.239" dst_port="58299"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617513048"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05406,1.15662,010,1 1 1 1 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="182.21.128.119" src_port="1433"/>
        </slice>
        <from usec="0" sec="1617512740"/>
        <to usec="0" sec="1617512837"/>
    </anomaly>
    <anomaly type="suspicious" value="0.931452,1.03932,020,1 1 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="134.17.213.224" src_port="44020" dst_port="51734"/>
            <filter dst_ip="216.109.172.217"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.221.55.194" dst_ip="13.74.211.24" src_port="80" dst_port="14208"/>
        </slice>
        <from usec="0" sec="1617513044"/>
        <to usec="0" sec="1617513046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.221.52.194" dst_ip="40.191.122.224" src_port="80" dst_port="37356"/>
            <filter src_ip="163.221.52.194" dst_ip="40.191.122.224" src_port="80" dst_port="37318"/>
        </slice>
        <from usec="0" sec="1617513289"/>
        <to usec="0" sec="1617513298"/>
    </anomaly>
    <anomaly type="suspicious" value="0.825881,1.11541,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="131.175.231.114" dst_ip="173.183.242.44" src_port="80" dst_port="62340"/>
        </slice>
        <from usec="0" sec="1617513040"/>
        <to usec="0" sec="1617513042"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09673,1.2054,504,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.221.196.184" dst_ip="13.248.194.220" dst_port="443"/>
        </slice>
        <from usec="0" sec="1617512630"/>
        <to usec="0" sec="1617513247"/>
    </anomaly>
    <anomaly type="suspicious" value="0.979475,1.09333,010,1 1 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="188.159.174.192" dst_ip="133.247.11.101"/>
            <filter src_ip="192.9.30.235" dst_port="512"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05061,1.10253,504,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="162.188.35.166" dst_port="443"/>
            <filter dst_ip="38.90.157.203" dst_port="8883"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.931452,1.03932,502,1 1 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="202.199.38.88"/>
            <filter dst_ip="61.206.80.44" src_port="22"/>
            <filter dst_ip="45.228.182.154" dst_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.929376,1.20543,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617513228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.929376,1.20543,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617513228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,004,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.25.166.190" dst_port="445"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617512508"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="45.1.121.136" src_port="4121"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617512687"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="203.77.59.165" dst_ip="120.125.86.222" src_port="443" dst_port="65158"/>
            <filter src_ip="203.77.59.165" dst_ip="120.125.86.222" src_port="443" dst_port="64955"/>
            <filter src_ip="203.77.59.165" dst_ip="120.125.86.222" src_port="40009" dst_port="62409"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617512508"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="165.136.255.141" dst_port="23"/>
        </slice>
        <from usec="0" sec="1617512401"/>
        <to usec="0" sec="1617512507"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,504,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.221.122.117" dst_ip="54.71.101.26" dst_port="443"/>
        </slice>
        <from usec="0" sec="1617512404"/>
        <to usec="0" sec="1617512508"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,010,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="203.77.48.251" dst_ip="64.143.230.142" src_port="53"/>
            <filter src_ip="202.199.12.7" dst_ip="64.143.230.142" src_port="53"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617512865"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="163.221.112.20" dst_ip="40.168.6.11" src_port="52448" dst_port="3544"/>
            <filter src_ip="163.221.236.206" dst_ip="40.168.6.11" src_port="61907" dst_port="3544"/>
            <filter src_ip="163.221.245.53" dst_ip="40.168.6.11" src_port="57412" dst_port="3544"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617512865"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,502,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.77.48.248" dst_ip="129.126.185.113" src_port="22"/>
        </slice>
        <from usec="0" sec="1617512423"/>
        <to usec="0" sec="1617512917"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,502,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.77.55.139" dst_ip="81.66.169.131" src_port="22"/>
        </slice>
        <from usec="0" sec="1617512418"/>
        <to usec="0" sec="1617512912"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.221.160.61" dst_ip="99.172.148.253" dst_port="443"/>
        </slice>
        <from usec="0" sec="1617512626"/>
        <to usec="0" sec="1617512893"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,502,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="163.221.48.210" dst_ip="157.201.132.139"/>
            <filter src_ip="163.221.48.210" src_port="22"/>
            <filter dst_ip="157.201.132.139" src_port="22"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617513125"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.221.121.103" dst_ip="52.17.180.220" src_port="53726" dst_port="443"/>
        </slice>
        <from usec="0" sec="1617512433"/>
        <to usec="0" sec="1617513037"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,502,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="202.207.220.193" dst_ip="49.212.139.207" src_port="22"/>
        </slice>
        <from usec="0" sec="1617512440"/>
        <to usec="0" sec="1617513028"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,502,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.228.28.73" dst_ip="181.128.144.196" src_port="22"/>
        </slice>
        <from usec="0" sec="1617512458"/>
        <to usec="0" sec="1617513134"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="116.121.150.21" dst_ip="121.30.208.94" src_port="443" dst_port="44069"/>
        </slice>
        <from usec="0" sec="1617513007"/>
        <to usec="0" sec="1617513019"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,999,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.25.166.125"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617513228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.878619,1.15666,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="163.221.147.121" dst_ip="52.74.102.106" src_port="50176" dst_port="443"/>
            <filter src_ip="163.221.147.121" dst_ip="52.74.102.106"/>
            <filter src_ip="163.221.255.205" dst_ip="52.74.102.106" src_port="52881" dst_port="443"/>
            <filter src_ip="163.221.144.172" dst_ip="52.74.102.106" src_port="60681" dst_port="443"/>
            <filter src_ip="202.207.223.111" dst_ip="52.74.102.106" src_port="62407" dst_port="443"/>
        </slice>
        <from usec="0" sec="1617512403"/>
        <to usec="0" sec="1617513195"/>
    </anomaly>
    <anomaly type="suspicious" value="1.46323,1.54001,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617513228"/>
    </anomaly>
    <anomaly type="suspicious" value="1.46323,1.54001,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617513228"/>
    </anomaly>
    <anomaly type="suspicious" value="1.56797,1.62881,999,0 0 0 1 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="51.77.254.170" dst_ip="202.199.38.88" dst_port="3283"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617512958"/>
    </anomaly>
    <anomaly type="suspicious" value="1.59696,1.6638,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_port="4040" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1617512580"/>
        <to usec="0" sec="1617512626"/>
    </anomaly>
    <anomaly type="suspicious" value="1.59696,1.6638,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="104.126.86.222"/>
        </slice>
        <from usec="0" sec="1617512805"/>
        <to usec="0" sec="1617512851"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05406,1.15662,010,1 1 1 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="42.6.94.187" dst_port="8291"/>
            <filter src_ip="42.6.94.187" dst_port="8728"/>
            <filter src_ip="42.6.94.187" dst_port="22"/>
            <filter src_ip="94.248.154.21" src_port="5083" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1617512400"/>
        <to usec="0" sec="1617513227"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02434,1.13538,999,0 0 0 1 1 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="163.221.30.220" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05061,1.10253,010,0 0 0 1 0 0 0 0 0 1 1 0,ntscSYN139445">
        <slice>
            <filter src_ip="186.216.210.180" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.770749,1.05284,999,1 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="172.105.248.208" dst_port="2628"/>
            <filter dst_ip="202.199.61.48" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02434,1.13538,020,0 0 0 1 1 0 0 0 0 1 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="54.64.193.139"/>
            <filter dst_ip="18.176.38.209"/>
            <filter dst_ip="18.176.172.174"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09341,1.1536,504,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="133.228.108.238" dst_ip="107.19.232.118"/>
            <filter src_ip="133.228.108.238" dst_port="443"/>
            <filter src_ip="133.228.108.238"/>
            <filter src_ip="133.228.108.236" dst_ip="107.19.232.118" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05061,1.10253,020,0 0 0 1 0 0 0 0 0 1 1 0,ttl_error">
        <slice>
            <filter src_ip="202.199.23.253"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09341,1.1536,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="13.48.107.67" dst_ip="163.221.91.47" src_port="443" dst_port="2848"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09341,1.1536,010,0 0 0 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="180.95.162.54" src_port="53184" dst_port="2375"/>
            <filter src_ip="180.95.162.54" src_port="53258" dst_port="2376"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09341,1.1536,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="51.143.100.126" dst_ip="203.77.38.129" src_port="30120" dst_port="5353"/>
            <filter src_ip="51.143.100.126" dst_ip="203.77.53.57" src_port="30120" dst_port="5353"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09341,1.1536,010,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="133.5.248.245" dst_port="25"/>
            <filter src_ip="145.48.177.5" dst_ip="133.5.248.245" dst_port="587"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
