<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="anomalous" value="1.6708,1.34393,999,1 0 0 1 0 0 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.207.112.172" dst_port="30303"/>
            <filter src_ip="165.228.126.83" dst_ip="203.207.112.172" src_port="32766"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.36283,1.24924,010,1 1 1 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="197.196.6.221" dst_port="137"/>
            <filter src_ip="222.209.208.30" src_port="23456"/>
            <filter src_ip="185.219.141.224" dst_port="8004"/>
            <filter src_ip="167.144.57.122" src_port="53724" dst_port="9384"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.476,1.2654,504,1 1 1 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="13.158.170.19" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.32412,1.90926,504,1 1 0 1 0 0 1 1 1 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.207.112.218" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.49567,1.97054,504,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter src_ip="106.13.94.193" dst_port="23"/>
            <filter src_ip="185.218.234.48" dst_port="5351"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.45755,1.29005,502,1 1 0 0 0 0 1 1 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="185.246.114.20" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.6736,1.3481,010,1 1 1 1 0 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="94.130.18.136"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.28379,1.13173,504,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.207.119.231" src_port="443"/>
            <filter src_ip="133.249.117.145" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.38731,1.18138,999,1 1 0 1 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.207.112.172" src_port="30303"/>
            <filter src_ip="203.207.112.172" dst_ip="165.228.126.83" dst_port="32766"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.71771,1.47904,999,1 1 0 1 1 0 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="203.207.123.7" dst_ip="206.100.219.62"/>
            <filter src_ip="203.207.123.7" dst_ip="204.197.215.213"/>
            <filter src_ip="203.207.123.7" dst_ip="50.128.203.193"/>
            <filter src_ip="203.207.123.7" dst_ip="128.205.117.145"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.43445,1.26908,504,1 0 0 1 0 0 1 1 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="52.168.229.76" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.11136,1.90422,503,0 1 1 0 0 0 1 1 1 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="60.6.127.82" dst_ip="203.207.123.175" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.49567,1.97054,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="222.198.31.161" src_port="9090" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.15901,1.87115,504,0 0 0 1 0 0 1 1 1 1 0 1,mptp">
        <slice>
            <filter dst_ip="202.198.145.146" src_port="53"/>
            <filter dst_ip="202.198.145.146" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.6736,1.3481,503,1 1 1 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="80"/>
            <filter src_ip="80.143.210.50" src_port="64344" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.06244,1.827,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="8.64.165.193" dst_ip="163.194.94.10" src_port="80"/>
        </slice>
        <from usec="0" sec="1625634000"/>
        <to usec="0" sec="1625634108"/>
    </anomaly>
    <anomaly type="anomalous" value="2.31925,1.86536,504,0 0 0 1 1 1 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="104.240.70.249" dst_ip="203.207.112.218" src_port="443" dst_port="59598"/>
            <filter src_ip="104.240.70.249" dst_ip="203.207.112.218" src_port="443" dst_port="59474"/>
            <filter src_ip="104.240.70.249" dst_ip="203.207.112.218" src_port="443" dst_port="46170"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.15286,1.09443,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.194.43.30" src_port="443"/>
            <filter dst_ip="163.194.43.30" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47423,1.4508,011,0 0 0 1 1 0 0 0 0 0 0 0,ntscTCPRSTrp">
        <slice>
            <filter dst_ip="212.234.90.252" dst_port="80"/>
        </slice>
        <from usec="0" sec="1625634000"/>
        <to usec="0" sec="1625634738"/>
    </anomaly>
    <anomaly type="anomalous" value="2.55389,2.00123,010,0 0 0 1 1 1 1 1 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="212.234.90.70" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.49567,1.97054,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="134.121.191.172" src_port="16360" dst_port="22"/>
            <filter src_ip="167.166.159.89" src_port="46809" dst_port="9054"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.31925,1.86536,054,0 0 0 1 1 1 0 0 0 1 1 1,malphfl">
        <slice>
            <filter src_ip="34.54.217.74" dst_ip="163.194.121.198" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.91853,1.81818,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="133.249.121.128" dst_ip="38.133.218.249" dst_port="53"/>
            <filter src_ip="133.249.121.149" dst_ip="38.133.218.249" dst_port="53"/>
        </slice>
        <from usec="0" sec="1625634000"/>
        <to usec="0" sec="1625634856"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92813,1.80123,020,0 0 0 0 0 0 1 1 1 1 0 0,ntscICecrqICecrqdurmterp">
        <slice>
            <filter dst_ip="203.207.127.9"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.45755,1.29005,999,1 1 0 0 0 0 1 1 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="188.124.109.16" dst_ip="133.235.190.77"/>
            <filter src_ip="80.145.34.9" dst_ip="133.235.190.77"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.91853,1.81818,999,0 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="133.249.121.149" dst_ip="38.133.218.240" dst_port="53"/>
            <filter src_ip="133.249.121.128" dst_ip="38.133.218.240" dst_port="53"/>
        </slice>
        <from usec="0" sec="1625634450"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="anomalous" value="1.91853,1.81818,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.249.121.149" dst_ip="38.133.218.248" dst_port="53"/>
        </slice>
        <from usec="0" sec="1625634450"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="anomalous" value="1.31649,1.31079,504,1 1 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="20.149.80.218" dst_port="443"/>
        </slice>
        <from usec="0" sec="1625634433"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="anomalous" value="1.91853,1.81818,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="210.66.161.147" dst_ip="163.194.202.3" dst_port="53"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="anomalous" value="1.91853,1.81818,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="216.21.241.153" dst_ip="203.207.112.255" dst_port="1194"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="anomalous" value="1.91853,1.81818,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="216.21.241.153" dst_ip="203.207.115.253" dst_port="1194"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="anomalous" value="2.37813,1.96236,999,1 1 1 0 0 0 1 1 1 1 1 1,alphfl">
        <slice>
            <filter src_ip="81.78.96.224" dst_ip="133.235.1.107" dst_port="6587"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.31925,1.86536,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.207.112.208" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.57244,1.31268,504,0 0 0 0 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.194.46.69" src_port="443"/>
            <filter dst_ip="163.194.45.154" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.31857,1.23594,504,0 0 0 0 0 0 1 1 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="131.142.16.65" dst_port="443"/>
            <filter dst_ip="216.113.194.187" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.24048,1.12204,504,0 0 0 1 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="13.140.41.51" dst_ip="203.207.112.218" src_port="443"/>
            <filter src_ip="52.69.185.162" dst_ip="203.207.112.218" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.31975,1.16307,011,0 0 0 0 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="222.198.31.161" src_port="22" dst_port="9090"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.20193,1.1856,504,1 1 1 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="14.15.38.26" dst_ip="163.194.215.14" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.30955,1.15519,504,1 1 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="163.194.169.24" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.60876,1.38961,504,1 1 1 0 0 0 1 1 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="163.194.122.251" dst_port="443"/>
            <filter dst_ip="20.151.165.17" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.31925,1.86536,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.194.237.55"/>
            <filter src_ip="17.186.183.247" src_port="80"/>
            <filter src_ip="17.186.183.247" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.15286,1.09443,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.194.254.19" src_port="443"/>
            <filter dst_ip="163.194.252.246" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.31127,1.88173,504,0 0 0 1 1 1 0 0 0 0 1 1,mptmp">
        <slice>
            <filter src_ip="23.46.204.187" src_port="443"/>
            <filter dst_ip="163.194.169.98" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.31925,1.86536,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.194.163.89" src_port="443"/>
            <filter dst_ip="163.194.232.111" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.87929,1.47912,503,1 1 1 1 0 0 1 1 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.207.123.175" dst_port="80"/>
            <filter dst_ip="203.207.115.205" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.71511,2.09961,504,1 1 1 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="202.203.43.246" dst_port="443"/>
            <filter src_ip="202.203.43.82" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.5454,1.28935,010,1 1 1 1 0 0 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="218.189.214.118" src_port="9090" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.13742,1.12845,010,1 0 0 1 0 0 0 0 0 1 0 1,mptmp">
        <slice>
            <filter src_ip="45.145.251.222" src_port="57755"/>
            <filter src_ip="150.189.220.250" src_port="44275"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.40657,1.90644,010,0 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="45.145.251.222" src_port="57755"/>
            <filter src_ip="192.13.220.220" src_port="47652" dst_port="3516"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.15286,1.09443,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="14.15.38.26" dst_ip="163.194.6.62"/>
            <filter src_ip="14.15.38.26" src_port="443"/>
            <filter dst_ip="163.194.6.62" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.15286,1.09443,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.169.6" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.28379,1.13173,504,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.194.247.14" src_port="443"/>
            <filter dst_ip="163.194.204.242" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.3427,1.8712,504,1 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.57.11" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.18384,1.13179,504,1 0 0 0 0 0 0 0 0 0 1 1,mptp">
        <slice>
            <filter dst_ip="203.207.112.208" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.15286,1.09443,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.207.115.205" src_port="80"/>
            <filter src_ip="203.207.115.205"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.476,1.2654,010,1 1 1 0 0 0 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="125.191.62.106" dst_port="13722"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.01794,1.80328,504,0 0 0 0 0 0 1 1 1 1 1 0,mptpla">
        <slice>
            <filter dst_ip="203.207.115.197" dst_port="443"/>
            <filter src_ip="216.21.241.153" dst_ip="203.207.115.197" dst_port="1194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.0955,1.82616,999,1 0 0 1 0 0 1 1 1 1 1 0,mptpla">
        <slice>
            <filter src_ip="203.207.115.197" dst_ip="216.21.241.153" src_port="1194"/>
            <filter src_ip="133.249.78.130" dst_ip="216.21.241.153" src_port="1194"/>
            <filter src_ip="203.207.112.255" dst_ip="216.21.241.153" src_port="1194"/>
            <filter src_ip="203.207.115.253" dst_ip="216.21.241.153" src_port="1194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.24048,1.12204,010,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="212.234.90.68" src_port="80"/>
            <filter src_ip="212.234.90.29" src_port="80"/>
            <filter src_ip="212.234.90.28" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.15286,1.09443,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.207.119.216" src_port="443"/>
            <filter dst_ip="133.21.180.0" src_port="443"/>
            <filter src_ip="1.253.115.28" dst_ip="203.207.119.216" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.24048,1.12204,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.12.232" src_port="443"/>
            <filter dst_ip="163.194.12.232" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.31975,1.16307,504,0 0 0 0 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.122.24" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.21706,1.86259,504,1 0 0 0 0 0 1 1 1 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.207.112.218" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.75753,1.47826,503,0 0 0 0 1 0 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="203.207.123.175" dst_ip="60.6.127.82" src_port="80"/>
            <filter src_ip="203.207.123.175" dst_ip="47.55.99.12" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.31925,1.86536,503,0 0 0 1 1 1 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.194.254.55" src_port="80"/>
            <filter dst_ip="163.194.254.55" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.15286,1.09443,503,0 0 0 0 0 0 0 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="163.194.255.89" src_port="5004"/>
            <filter dst_ip="163.194.255.89" src_port="80"/>
            <filter dst_ip="163.194.255.89" src_port="33434"/>
            <filter dst_ip="163.194.255.89" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.15286,1.09443,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.253.92" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,504,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="104.253.253.219" dst_ip="163.194.123.128" src_port="443" dst_port="64662"/>
        </slice>
        <from usec="0" sec="1625634711"/>
        <to usec="0" sec="1625634829"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.194.169.98" dst_ip="13.158.171.108" src_port="56395" dst_port="59289"/>
        </slice>
        <from usec="0" sec="1625634537"/>
        <to usec="0" sec="1625634538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="99.84.200.186" dst_ip="163.194.254.85" src_port="443" dst_port="59134"/>
        </slice>
        <from usec="0" sec="1625634169"/>
        <to usec="0" sec="1625634200"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="192.13.223.144" dst_port="8728"/>
            <filter src_ip="192.13.223.144" dst_port="8291"/>
            <filter src_ip="192.13.223.144" dst_port="22"/>
        </slice>
        <from usec="0" sec="1625634001"/>
        <to usec="0" sec="1625634899"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990449,1.06718,999,1 1 0 0 0 0 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="213.150.229.112" dst_ip="203.207.122.37" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,504,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="54.150.123.115" dst_ip="203.207.109.25" src_port="443" dst_port="50881"/>
        </slice>
        <from usec="0" sec="1625634361"/>
        <to usec="0" sec="1625634362"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="23.208.67.186" dst_ip="163.194.253.233" src_port="80" dst_port="35010"/>
            <filter src_ip="23.208.67.186" dst_ip="163.194.253.233" src_port="80" dst_port="35008"/>
        </slice>
        <from usec="0" sec="1625634585"/>
        <to usec="0" sec="1625634590"/>
    </anomaly>
    <anomaly type="suspicious" value="1.09119,1.09547,999,1 1 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="38.133.218.253" src_port="53"/>
            <filter dst_ip="163.194.174.237" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.194.123.136" dst_ip="54.131.201.164" dst_port="80"/>
        </slice>
        <from usec="0" sec="1625634460"/>
        <to usec="0" sec="1625634461"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,999,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="35.220.65.241" dst_ip="203.207.122.62" dst_port="53"/>
        </slice>
        <from usec="0" sec="1625634487"/>
        <to usec="0" sec="1625634488"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="142.165.37.223" src_port="54249" dst_port="8291"/>
        </slice>
        <from usec="0" sec="1625634250"/>
        <to usec="0" sec="1625634263"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914496,1.09209,999,1 1 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="111.232.235.131"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,011,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="47.175.245.113" src_port="21" dst_port="21"/>
        </slice>
        <from usec="0" sec="1625634012"/>
        <to usec="0" sec="1625634122"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.80.47.177" src_port="45660" dst_port="3702"/>
        </slice>
        <from usec="0" sec="1625634693"/>
        <to usec="0" sec="1625634739"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,502,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="222.198.42.235" dst_port="22"/>
        </slice>
        <from usec="0" sec="1625634012"/>
        <to usec="0" sec="1625634014"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="136.108.80.62" dst_port="445"/>
        </slice>
        <from usec="0" sec="1625634533"/>
        <to usec="0" sec="1625634535"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="49.42.15.193" dst_port="1433"/>
            <filter src_ip="49.42.15.193" dst_port="445"/>
        </slice>
        <from usec="0" sec="1625634469"/>
        <to usec="0" sec="1625634477"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="54.223.132.138"/>
        </slice>
        <from usec="0" sec="1625634629"/>
        <to usec="0" sec="1625634648"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="171.148.128.228" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634202"/>
        <to usec="0" sec="1625634203"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="27.39.163.108" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634196"/>
        <to usec="0" sec="1625634198"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="124.162.41.107" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634393"/>
        <to usec="0" sec="1625634394"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="221.99.9.5" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634636"/>
        <to usec="0" sec="1625634639"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="188.171.127.97" dst_port="445"/>
        </slice>
        <from usec="0" sec="1625634468"/>
        <to usec="0" sec="1625634469"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="117.73.6.160" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634425"/>
        <to usec="0" sec="1625634427"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="117.43.82.51" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634481"/>
        <to usec="0" sec="1625634482"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="91.221.193.55" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634050"/>
        <to usec="0" sec="1625634051"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="59.33.204.198" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634148"/>
        <to usec="0" sec="1625634150"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="182.168.44.254" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634057"/>
        <to usec="0" sec="1625634062"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.61.24.51" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634036"/>
        <to usec="0" sec="1625634040"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="223.171.137.139" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634569"/>
        <to usec="0" sec="1625634571"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.61.24.52" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634489"/>
        <to usec="0" sec="1625634490"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="123.44.2.207" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634237"/>
        <to usec="0" sec="1625634238"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="163.178.48.136" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634229"/>
        <to usec="0" sec="1625634231"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.70.196.195" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634518"/>
        <to usec="0" sec="1625634519"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="146.187.240.5" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634203"/>
        <to usec="0" sec="1625634208"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="14.104.142.30" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634292"/>
        <to usec="0" sec="1625634294"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.191.36.158" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634636"/>
        <to usec="0" sec="1625634639"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="202.35.79.22" dst_port="1433"/>
            <filter src_ip="202.35.79.22" dst_port="445"/>
        </slice>
        <from usec="0" sec="1625634730"/>
        <to usec="0" sec="1625634738"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="111.242.35.137" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634475"/>
        <to usec="0" sec="1625634477"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.223.134.143" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634742"/>
        <to usec="0" sec="1625634743"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="210.239.100.119" dst_port="445"/>
            <filter src_ip="210.239.100.119" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634572"/>
        <to usec="0" sec="1625634576"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="95.38.253.103" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634306"/>
        <to usec="0" sec="1625634308"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.84.248.74" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634839"/>
        <to usec="0" sec="1625634843"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="2.203.168.161" dst_port="445"/>
            <filter src_ip="2.203.168.161" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634669"/>
        <to usec="0" sec="1625634675"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="5.92.34.76" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634838"/>
        <to usec="0" sec="1625634840"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="122.11.142.76" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1625634216"/>
        <to usec="0" sec="1625634263"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="120.160.147.204" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1625634445"/>
        <to usec="0" sec="1625634446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="94.55.237.208" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634052"/>
        <to usec="0" sec="1625634055"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.104.238.43" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634117"/>
        <to usec="0" sec="1625634119"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="39.173.133.224" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1625634521"/>
        <to usec="0" sec="1625634522"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="47.224.44.14" dst_port="445"/>
        </slice>
        <from usec="0" sec="1625634744"/>
        <to usec="0" sec="1625634747"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.218.234.49" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1625634031"/>
        <to usec="0" sec="1625634613"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.218.234.53" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1625634806"/>
        <to usec="0" sec="1625634807"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.92.6.199" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634314"/>
        <to usec="0" sec="1625634318"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="178.209.14.252" dst_port="445"/>
        </slice>
        <from usec="0" sec="1625634433"/>
        <to usec="0" sec="1625634436"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.45.2.0" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634825"/>
        <to usec="0" sec="1625634827"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="192.13.222.75" src_port="8181"/>
        </slice>
        <from usec="0" sec="1625634021"/>
        <to usec="0" sec="1625634032"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="120.160.147.204" src_port="6379"/>
        </slice>
        <from usec="0" sec="1625634445"/>
        <to usec="0" sec="1625634446"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,999,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.207.126.158" dst_ip="151.114.217.59" dst_port="53"/>
        </slice>
        <from usec="0" sec="1625634076"/>
        <to usec="0" sec="1625634077"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791579,1.06371,052,1 1 0 0 0 0 0 0 0 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="196.221.165.108" dst_ip="203.207.123.57" dst_port="22"/>
            <filter src_ip="196.221.165.108" dst_ip="203.207.123.57" dst_port="8728"/>
            <filter src_ip="196.221.165.108" dst_ip="203.207.123.57" dst_port="8291"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.7679,1.09216,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter src_ip="203.207.125.246" dst_ip="38.133.218.218"/>
            <filter dst_ip="38.133.218.218" dst_port="80"/>
        </slice>
        <from usec="0" sec="1625634850"/>
        <to usec="0" sec="1625634851"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="222.209.208.30" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1625634053"/>
        <to usec="0" sec="1625634760"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="188.124.109.16" dst_port="445"/>
            <filter src_ip="188.124.109.16" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634161"/>
        <to usec="0" sec="1625634166"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,504,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="104.240.222.226" dst_ip="163.194.189.64" src_port="443" dst_port="50118"/>
        </slice>
        <from usec="0" sec="1625634562"/>
        <to usec="0" sec="1625634565"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21077,1.27065,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="106.13.191.212" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1625634180"/>
        <to usec="0" sec="1625634515"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="71.246.21.65" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634136"/>
        <to usec="0" sec="1625634138"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.83.231.115" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634703"/>
        <to usec="0" sec="1625634704"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="123.43.61.89" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634124"/>
        <to usec="0" sec="1625634125"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.229.217.58" dst_port="445"/>
        </slice>
        <from usec="0" sec="1625634431"/>
        <to usec="0" sec="1625634434"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="124.131.22.137" dst_port="8291"/>
            <filter src_ip="124.131.22.137" dst_port="22"/>
            <filter src_ip="124.131.22.137" dst_port="8728"/>
        </slice>
        <from usec="0" sec="1625634527"/>
        <to usec="0" sec="1625634867"/>
    </anomaly>
    <anomaly type="suspicious" value="0.881369,1.15964,010,1 0 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="60.76.166.163" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1625634212"/>
        <to usec="0" sec="1625634213"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.218.234.52" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1625634087"/>
        <to usec="0" sec="1625634442"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="126.191.189.92" dst_ip="163.194.173.43" dst_port="2222"/>
            <filter src_ip="126.191.189.92" dst_ip="163.194.85.43" dst_port="3283"/>
        </slice>
        <from usec="0" sec="1625634124"/>
        <to usec="0" sec="1625634582"/>
    </anomaly>
    <anomaly type="suspicious" value="1.02631,1.20814,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="213.238.33.248" dst_port="22"/>
            <filter src_ip="213.238.33.248" dst_port="8291"/>
            <filter src_ip="213.238.33.248" dst_port="8728"/>
        </slice>
        <from usec="0" sec="1625634004"/>
        <to usec="0" sec="1625634900"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914496,1.09209,010,1 1 0 1 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="192.13.192.93" dst_port="9160"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.956131,1.04174,010,1 0 0 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="212.234.90.237" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.14015,1.20808,010,1 1 1 1 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="119.94.60.196" dst_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.40131,1.42956,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1625634000"/>
        <to usec="0" sec="1625634828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.40131,1.42956,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1625634000"/>
        <to usec="0" sec="1625634828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.51134,1.51303,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1625634000"/>
        <to usec="0" sec="1625634828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.51134,1.51303,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1625634000"/>
        <to usec="0" sec="1625634828"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16074,1.25758,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="133.249.121.149" dst_ip="38.133.218.242" dst_port="53"/>
            <filter src_ip="133.249.121.128" dst_ip="38.133.218.242" dst_port="53"/>
        </slice>
        <from usec="0" sec="1625634000"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.785175,1.10049,999,0 0 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.249.121.128" dst_ip="38.133.218.240" dst_port="53"/>
        </slice>
        <from usec="0" sec="1625634000"/>
        <to usec="0" sec="1625634046"/>
    </anomaly>
    <anomaly type="suspicious" value="0.908958,1.12796,010,0 0 0 1 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="45.145.251.222" src_port="57755"/>
        </slice>
        <from usec="0" sec="1625634001"/>
        <to usec="0" sec="1625634727"/>
    </anomaly>
    <anomaly type="suspicious" value="0.785175,1.10049,002,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="192.13.206.139"/>
        </slice>
        <from usec="0" sec="1625634405"/>
        <to usec="0" sec="1625634451"/>
    </anomaly>
    <anomaly type="suspicious" value="0.908958,1.12796,999,0 0 0 1 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="216.21.241.153" dst_ip="203.207.115.197" dst_port="1194"/>
            <filter src_ip="216.21.241.153" dst_ip="203.207.112.255" dst_port="1194"/>
            <filter src_ip="216.21.241.153" dst_ip="203.207.115.253" dst_port="1194"/>
        </slice>
        <from usec="0" sec="1625634000"/>
        <to usec="0" sec="1625634558"/>
    </anomaly>
    <anomaly type="suspicious" value="0.908958,1.12796,010,0 0 0 1 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="185.219.141.224" dst_port="8004"/>
        </slice>
        <from usec="0" sec="1625634004"/>
        <to usec="0" sec="1625634555"/>
    </anomaly>
    <anomaly type="suspicious" value="0.785175,1.10049,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="207.224.60.65" src_port="54449" dst_port="27017"/>
        </slice>
        <from usec="0" sec="1625634495"/>
        <to usec="0" sec="1625634541"/>
    </anomaly>
    <anomaly type="suspicious" value="0.851949,1.11037,999,1 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.207.122.32" dst_port="53"/>
        </slice>
        <from usec="0" sec="1625634720"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.785175,1.10049,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="42.90.209.2"/>
        </slice>
        <from usec="0" sec="1625634720"/>
        <to usec="0" sec="1625634766"/>
    </anomaly>
    <anomaly type="suspicious" value="0.785175,1.10049,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="38.133.218.237" dst_port="53"/>
            <filter src_ip="163.194.173.43" dst_ip="38.133.218.237" dst_port="80"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21077,1.27065,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="62.160.17.219" dst_port="8291"/>
            <filter src_ip="62.160.17.219" dst_port="22"/>
            <filter src_ip="62.160.17.219" dst_port="8728"/>
        </slice>
        <from usec="0" sec="1625634651"/>
        <to usec="0" sec="1625634876"/>
    </anomaly>
    <anomaly type="suspicious" value="1.65741,1.68571,999,0 0 0 1 0 0 0 0 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="133.249.121.128" dst_ip="38.133.218.242" dst_port="53"/>
            <filter src_ip="133.249.121.149" dst_ip="38.133.218.242" dst_port="53"/>
        </slice>
        <from usec="0" sec="1625634000"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.785175,1.10049,504,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="13.63.149.227" dst_port="443"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.785175,1.10049,504,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="117.244.37.209" dst_port="443"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.785175,1.10049,504,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="54.71.89.43" dst_port="443"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.785175,1.10049,002,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="74.127.225.236" dst_port="137"/>
        </slice>
        <from usec="0" sec="1625634810"/>
        <to usec="0" sec="1625634856"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16074,1.25758,999,0 0 0 0 0 0 1 1 0 0 0 0,DDoSUDP">
        <slice>
            <filter dst_ip="38.133.218.214" dst_port="53"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16074,1.25758,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="203.207.123.32" dst_port="53"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16074,1.25758,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.235.190.76" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06975,1.21974,999,0 0 0 1 0 0 0 1 0 0 0 0,DDoSUDP">
        <slice>
            <filter dst_ip="133.235.8.185" dst_port="58909"/>
            <filter dst_ip="133.235.8.185" dst_port="4128"/>
        </slice>
        <from usec="0" sec="1625634000"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16074,1.25758,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.207.122.62" dst_port="53"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966776,1.19439,504,0 0 0 0 0 0 0 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.194.57.11" src_port="443"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16074,1.25758,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.194.175.2" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966776,1.19439,504,0 0 0 0 0 0 0 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.194.79.109" src_port="443"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16074,1.25758,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.194.146.138"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17654,1.23294,504,0 0 0 0 0 0 1 1 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="163.194.92.196" dst_ip="13.39.97.58" dst_port="443"/>
            <filter src_ip="163.194.92.196" dst_ip="52.69.223.192" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16074,1.25758,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.235.189.180" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16074,1.25758,010,0 0 0 0 0 0 1 1 0 0 0 0,poscaSYN">
        <slice>
            <filter src_ip="143.11.179.110" dst_ip="163.194.216.71" src_port="32766"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966776,1.19439,504,0 0 0 0 0 0 0 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="52.89.75.87" dst_ip="163.194.253.68" src_port="443"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16074,1.25758,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="133.249.123.7" dst_ip="163.194.253.56" src_port="53"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16074,1.25758,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.235.189.212" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16074,1.25758,504,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="18.203.215.185" dst_ip="203.207.123.245" dst_port="443"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16074,1.25758,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="122.228.45.221"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.16074,1.25758,504,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="54.129.220.29" dst_port="443"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22211,1.24176,999,1 0 0 0 0 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter dst_port="53"/>
            <filter src_ip="133.249.123.107" dst_ip="198.247.79.44" src_port="53"/>
            <filter src_ip="202.203.43.20" dst_ip="198.247.79.44" src_port="53"/>
            <filter src_ip="133.249.60.240" dst_ip="198.247.79.44" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.785175,1.10049,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="133.249.121.149" dst_ip="38.133.218.249" dst_port="53"/>
            <filter src_ip="133.249.121.128" dst_ip="38.133.218.249" dst_port="53"/>
        </slice>
        <from usec="0" sec="1625634450"/>
        <to usec="0" sec="1625634496"/>
    </anomaly>
    <anomaly type="suspicious" value="0.808348,1.07226,010,0 0 0 0 0 0 1 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="45.108.234.144" src_port="54288" dst_port="2375"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990449,1.06718,004,1 1 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="133.235.176.209" dst_ip="168.31.252.44" src_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.194.4.84" src_port="443"/>
            <filter dst_ip="163.194.4.84" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.808348,1.07226,504,0 0 0 0 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="204.197.215.213" dst_port="443"/>
            <filter dst_ip="35.68.200.104" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.785175,1.10049,504,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.194.7.238" dst_port="443"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="1.05695,1.0858,999,1 0 0 0 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="163.194.174.195" dst_port="53"/>
            <filter dst_ip="38.133.218.253" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.785175,1.10049,504,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="18.177.146.97" dst_port="443"/>
        </slice>
        <from usec="0" sec="1625634765"/>
        <to usec="0" sec="1625634811"/>
    </anomaly>
    <anomaly type="suspicious" value="0.897144,1.03121,010,0 0 0 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="212.234.90.80" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.897144,1.03121,504,0 0 0 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.203.46.86" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.808348,1.07226,010,0 0 0 0 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="202.26.247.31" dst_ip="97.95.125.238"/>
            <filter src_ip="202.26.247.31" src_port="80"/>
            <filter src_ip="202.26.247.31" src_port="443"/>
            <filter dst_ip="97.95.125.238" src_port="80"/>
            <filter dst_ip="97.95.125.238" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.839334,1.01194,999,1 0 0 0 0 0 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="206.100.219.62" dst_ip="203.207.123.7"/>
            <filter src_ip="204.197.215.213" dst_ip="203.207.123.7"/>
            <filter src_ip="50.128.203.193" dst_ip="203.207.123.7"/>
            <filter src_ip="128.205.117.145" dst_ip="203.207.123.7"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.808348,1.07226,010,0 0 0 0 0 0 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="133.235.190.12" dst_port="50356"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.10341,1.10378,010,0 0 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="5.60.193.50"/>
            <filter src_ip="150.189.246.246" src_port="54179" dst_port="39885"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.897144,1.03121,504,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="23.210.222.75" src_port="443"/>
            <filter dst_ip="163.194.123.14" src_port="443"/>
            <filter dst_ip="163.194.254.177" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.791579,1.06371,999,1 1 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.194.252.199" dst_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="123.44.2.209"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="111.232.235.169"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.897144,1.03121,999,0 0 0 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.194.156.100" src_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.203.43.93" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="150.189.223.76" src_port="443"/>
            <filter src_ip="150.189.223.76" dst_ip="163.194.123.74" src_port="9000"/>
            <filter src_ip="150.189.223.76" dst_ip="163.194.52.150" src_port="9000"/>
            <filter src_ip="150.189.223.76" dst_ip="163.194.52.143" src_port="9000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.785175,1.10049,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.207.115.205" dst_port="80"/>
            <filter dst_ip="203.207.115.205"/>
        </slice>
        <from usec="0" sec="1625634180"/>
        <to usec="0" sec="1625634226"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,504,0 0 0 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="163.194.46.159" dst_ip="92.214.40.244" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,503,0 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="177.171.191.189" dst_ip="203.207.117.228" src_port="80" dst_port="53"/>
            <filter src_ip="177.171.191.189" dst_ip="202.198.181.51" src_port="80" dst_port="53"/>
            <filter src_ip="177.171.191.189" dst_ip="203.207.114.218" src_port="80" dst_port="53"/>
            <filter src_ip="177.171.191.189" dst_ip="202.198.135.164" src_port="80" dst_port="53"/>
            <filter src_ip="177.171.191.189" dst_ip="202.198.134.230" src_port="80" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="185.165.95.101" dst_port="1024"/>
            <filter src_ip="185.165.95.101" src_port="54316" dst_port="7170"/>
            <filter src_ip="185.165.95.101" src_port="61639" dst_port="593"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,502,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="202.203.44.101" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,010,0 0 0 0 0 0 0 0 0 1 1 0,malphfl">
        <slice>
            <filter src_ip="202.203.44.130" dst_ip="74.127.225.160" src_port="2000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.194.65.97" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="204.118.64.172" dst_ip="163.194.7.254" src_port="443" dst_port="39818"/>
            <filter src_ip="204.118.64.172" dst_ip="163.194.7.254" src_port="443" dst_port="39662"/>
            <filter src_ip="204.118.64.172" dst_ip="163.194.252.91" src_port="443" dst_port="38090"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="23.61.64.177" dst_ip="163.194.253.68" src_port="443" dst_port="5215"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,999,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="31.45.106.29" dst_port="587"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="52.191.13.60" dst_ip="203.207.126.214" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,010,0 0 0 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="64.29.92.101" src_port="52945" dst_port="27000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="65.226.222.116" dst_ip="163.194.253.233" src_port="443" dst_port="55490"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="8.72.185.252" dst_ip="163.194.252.216" src_port="443" dst_port="52395"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,999,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="202.198.150.132" dst_ip="163.194.79.112" src_port="25"/>
            <filter src_ip="202.198.150.132" dst_ip="163.194.79.112" dst_port="113"/>
            <filter src_ip="47.55.99.12" dst_ip="163.194.79.112" src_port="587"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="54.246.117.58" dst_ip="163.194.252.54" src_port="443"/>
            <filter src_ip="54.246.117.58" dst_ip="163.194.51.77" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.876322,1.06054,504,0 0 0 1 0 0 0 0 0 0 1 0,mptmp">
        <slice>
            <filter dst_ip="163.194.122.120" src_port="443"/>
            <filter dst_ip="163.194.178.155" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0712,1.14583,504,0 0 0 1 0 0 0 0 0 0 0 1,alphfl">
        <slice>
            <filter src_ip="23.46.205.120" dst_ip="163.194.254.177" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,503,0 0 0 0 0 0 0 0 0 1 1 0,point_to_point">
        <slice>
            <filter src_ip="23.210.222.46" dst_ip="163.194.55.36" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.785175,1.10049,011,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="218.189.214.118" src_port="22" dst_port="9090"/>
        </slice>
        <from usec="0" sec="1625634315"/>
        <to usec="0" sec="1625634361"/>
    </anomaly>
    <anomaly type="suspicious" value="0.771468,1.0011,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.194.254.82" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
