<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="anomalous" value="1.55202,1.43935,504,1 1 1 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="163.217.195.227" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.99112,1.64887,999,1 1 0 0 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.109.245.8" dst_ip="206.215.124.14"/>
            <filter src_ip="203.109.245.8" dst_ip="204.98.94.36"/>
            <filter src_ip="203.109.245.8" dst_ip="50.8.85.241"/>
            <filter src_ip="203.109.245.8" dst_ip="128.225.1.145"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.04183,1.69076,011,1 0 1 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="162.234.15.212" src_port="13053"/>
            <filter src_ip="62.34.242.237" src_port="9999" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.43773,1.349,010,1 1 0 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="77.33.112.127" dst_port="5555"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.99119,1.74054,010,1 1 1 1 1 0 0 0 0 1 0 1,ptmp">
        <slice>
            <filter src_ip="193.237.29.111" src_port="49764"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.85801,3.22985,999,1 1 1 1 0 0 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.109.252.182" dst_ip="185.109.26.214"/>
            <filter src_ip="203.109.252.182" src_port="1194"/>
            <filter src_ip="203.109.255.111" dst_ip="185.109.26.214"/>
            <filter src_ip="203.109.255.111" src_port="1194"/>
            <filter src_ip="203.109.252.131" dst_ip="185.109.26.214"/>
            <filter src_ip="203.109.252.131" src_port="1194"/>
            <filter dst_ip="185.109.26.214" src_port="1194"/>
            <filter dst_ip="177.4.8.151" src_port="1194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.07516,1.72357,999,1 1 1 0 0 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="128.225.1.145" dst_ip="203.109.245.8"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.49046,1.43711,010,1 1 1 1 0 0 1 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="47.236.75.20" dst_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.138,1.7334,010,1 0 0 1 1 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="45.116.72.110" src_port="56093"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.94656,1.6117,010,1 0 0 1 0 0 0 0 0 1 1 1,sntscSYN">
        <slice>
            <filter src_ip="136.175.202.191" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.06333,1.76217,010,1 1 1 1 1 0 1 1 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="198.131.43.34" dst_port="81"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.38919,1.30681,012,1 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="47.231.82.229" dst_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.06592,1.72092,010,1 1 1 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="80.173.141.224" dst_port="9000"/>
            <filter src_ip="92.147.133.33" src_port="50482"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.78289,3.16509,999,0 0 0 1 0 0 1 1 1 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.109.252.180" dst_port="13273"/>
            <filter src_ip="3.241.139.57" dst_ip="202.254.240.154" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.24721,1.83539,010,1 1 1 1 1 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="78.64.75.241"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.23623,1.78675,999,1 1 0 1 1 0 1 1 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="162.225.68.7" src_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54555,1.49129,999,0 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="163.217.58.172" dst_port="53"/>
            <filter src_ip="163.217.59.220" dst_port="53"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399618"/>
    </anomaly>
    <anomaly type="anomalous" value="1.60576,1.43371,504,0 0 0 1 1 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="163.217.129.22" dst_port="443"/>
            <filter dst_ip="162.29.38.117" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.48052,2.85998,010,1 1 0 1 1 1 1 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="23.61.181.53" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.24721,1.83539,010,1 1 1 1 1 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="89.0.61.105"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.40188,1.3936,504,0 0 0 1 0 0 0 1 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="20.197.161.241" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54555,1.49129,010,0 0 0 1 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="71.186.177.104" dst_ip="202.102.149.213" dst_port="443"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.149.213" dst_port="80"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399358"/>
    </anomaly>
    <anomaly type="anomalous" value="1.73304,1.57239,010,1 1 1 1 1 0 1 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.120.158.36" dst_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54555,1.49129,010,0 0 0 1 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="45.134.55.183" src_port="22" dst_port="33937"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399559"/>
    </anomaly>
    <anomaly type="anomalous" value="3.30842,2.77045,010,0 0 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="45.181.55.94" src_port="30100"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.46075,2.84033,504,1 0 0 1 1 1 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.217.129.92" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78064,1.62205,010,0 0 0 1 1 0 1 1 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.30.80.1" src_port="80"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399175"/>
    </anomaly>
    <anomaly type="anomalous" value="3.52927,2.90369,999,1 1 1 1 1 1 1 0 0 1 1 1,ntscUDPDNS">
        <slice>
            <filter src_ip="45.113.20.113" src_port="33593" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.94381,1.65568,502,1 0 0 1 1 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="203.109.255.92" dst_ip="74.29.13.193"/>
            <filter src_ip="203.109.255.92" dst_port="22"/>
            <filter dst_ip="74.29.13.193" dst_port="22"/>
            <filter src_ip="133.196.95.89" dst_ip="199.12.193.236" src_port="1028"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78064,1.62205,011,0 0 0 1 1 0 1 1 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="45.100.13.68" dst_port="43553"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399538"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34034,1.28391,020,0 0 0 1 0 0 0 0 0 1 1 0,ttl_error">
        <slice>
            <filter src_ip="202.254.201.126"/>
            <filter src_ip="203.109.243.200"/>
            <filter src_ip="202.254.235.12"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34034,1.28391,999,0 0 0 1 0 0 0 0 0 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.217.59.228" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.22359,2.90478,504,0 0 0 1 0 0 0 1 1 1 0 0,mptmp">
        <slice>
            <filter src_ip="133.221.3.98" dst_ip="172.114.76.44" dst_port="443"/>
            <filter dst_ip="3.188.156.126"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54555,1.49129,901,0 0 0 1 0 0 1 1 0 0 0 0,empty">
        <slice/>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399448"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54555,1.49129,020,0 0 0 1 0 0 1 1 0 0 0 0,ntscUDPUDPICrp">
        <slice>
            <filter dst_ip="146.40.220.133"/>
            <filter dst_ip="45.111.63.12"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399628"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54555,1.49129,010,0 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="202.244.217.77"/>
            <filter dst_ip="167.24.133.40"/>
            <filter dst_ip="49.223.107.194" src_port="22"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399448"/>
    </anomaly>
    <anomaly type="anomalous" value="1.4373,1.41261,020,0 0 0 1 1 0 0 0 0 0 1 0,netout">
        <slice>
            <filter src_ip="202.127.181.1"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.77552,1.57152,010,1 1 1 1 1 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="103.221.54.85" dst_port="8728"/>
            <filter src_ip="103.221.54.85" dst_port="22"/>
            <filter src_ip="103.221.54.85" dst_port="8291"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54555,1.49129,999,0 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="174.140.241.70" src_port="3142" dst_port="54598"/>
            <filter dst_ip="52.221.223.134"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399628"/>
    </anomaly>
    <anomaly type="anomalous" value="3.52927,2.90369,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="221.67.194.160" src_port="9090" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.49899,3.04074,503,1 0 0 0 1 0 1 1 1 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.109.245.175" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.30842,2.77045,504,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.217.92.211" src_port="443"/>
            <filter dst_ip="203.109.229.105" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.67653,1.48921,504,1 1 0 1 1 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.217.225.9" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.60576,1.43371,020,0 0 0 1 1 0 0 0 0 1 1 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="14.201.52.202"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78064,1.62205,010,0 0 0 1 1 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="202.102.149.39"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.149.228"/>
            <filter src_ip="71.186.177.104" dst_port="80"/>
            <filter src_ip="71.186.177.104" dst_port="443"/>
            <filter dst_ip="202.102.149.228" dst_port="80"/>
            <filter dst_ip="202.102.149.228" dst_port="443"/>
            <filter dst_ip="202.102.149.42" dst_port="80"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399534"/>
    </anomaly>
    <anomaly type="anomalous" value="3.70265,3.0107,999,1 1 1 1 1 1 1 1 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="192.30.82.229" dst_port="3479"/>
            <filter src_ip="45.104.247.197" src_port="52734" dst_port="53"/>
            <filter src_ip="45.104.247.197" src_port="39429" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78364,1.57714,503,0 0 0 1 0 0 0 0 0 0 1 1,mptmp">
        <slice>
            <filter src_ip="117.34.242.252" src_port="80"/>
            <filter dst_ip="163.217.224.136" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.00801,2.60316,504,0 0 0 1 1 1 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="203.109.240.30" src_port="53"/>
            <filter dst_ip="203.109.240.30" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.52927,2.90369,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="45.134.55.183" src_port="33937" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.58972,2.44525,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398998"/>
    </anomaly>
    <anomaly type="anomalous" value="2.58972,2.44525,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398998"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54555,1.49129,020,0 0 0 1 0 0 1 1 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="18.50.45.70"/>
            <filter dst_ip="52.55.117.198"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399358"/>
    </anomaly>
    <anomaly type="anomalous" value="2.06326,1.67168,999,1 1 0 0 0 0 1 1 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="185.109.26.214" dst_ip="203.109.252.182" dst_port="1194"/>
            <filter src_ip="130.44.210.211" dst_ip="203.109.252.182" dst_port="1194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78064,1.62205,504,0 0 0 1 1 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="20.197.161.241" dst_port="443"/>
            <filter dst_ip="3.186.144.112"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399537"/>
    </anomaly>
    <anomaly type="anomalous" value="3.30882,2.96292,999,1 0 0 0 0 0 1 1 1 0 0 0,mptpla">
        <slice>
            <filter src_ip="133.221.33.115" dst_ip="177.4.8.151" src_port="1194"/>
            <filter src_ip="203.109.255.111" dst_ip="177.4.8.151" src_port="1194"/>
            <filter src_ip="203.109.252.131" dst_ip="177.4.8.151" src_port="1194"/>
            <filter src_ip="203.109.252.182" dst_ip="177.4.8.151" src_port="1194"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398961"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54555,1.49129,504,0 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="163.217.240.73" dst_port="443"/>
            <filter dst_ip="3.224.189.173"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399538"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78064,1.62205,999,0 0 0 1 1 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="210.66.132.235" dst_ip="163.217.100.237" dst_port="53"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399538"/>
    </anomaly>
    <anomaly type="anomalous" value="1.70334,1.51129,999,0 0 0 1 0 0 1 1 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.109.244.160" dst_port="53"/>
            <filter dst_ip="203.109.244.184" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54555,1.49129,020,0 0 0 1 0 0 1 1 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="35.75.73.3"/>
            <filter dst_ip="3.221.81.17"/>
            <filter dst_ip="18.46.29.185"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399176"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,999,0 0 0 0 0 0 1 1 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="185.109.26.214" dst_ip="203.109.255.111" dst_port="1194"/>
            <filter src_ip="130.44.210.211" dst_ip="203.109.255.111" dst_port="1194"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399386"/>
    </anomaly>
    <anomaly type="anomalous" value="3.29442,2.95445,504,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="203.109.255.90" dst_ip="52.197.218.45" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399251"/>
    </anomaly>
    <anomaly type="anomalous" value="1.80714,1.63744,999,1 0 0 1 1 0 1 1 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="199.12.193.236"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399693"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.109.242.130" dst_port="53"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54555,1.49129,020,0 0 0 1 0 0 1 1 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="133.221.97.11"/>
            <filter dst_ip="18.18.112.167"/>
        </slice>
        <from usec="0" sec="1628398835"/>
        <to usec="0" sec="1628399532"/>
    </anomaly>
    <anomaly type="anomalous" value="1.71453,1.51431,999,0 0 0 0 0 0 1 1 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="185.109.26.214" dst_ip="203.109.252.131" dst_port="1194"/>
            <filter src_ip="185.109.26.214" dst_ip="203.109.255.111" dst_port="1194"/>
            <filter src_ip="185.109.26.214" dst_ip="203.109.252.182" dst_port="1194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.196.93.186" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,010,0 0 0 0 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="71.186.177.104" dst_port="443"/>
            <filter dst_ip="202.102.144.72" dst_port="443"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.72" dst_port="80"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="anomalous" value="2.72953,2.52531,504,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="104.147.253.196" dst_ip="163.217.240.73" src_port="443"/>
        </slice>
        <from usec="0" sec="1628399099"/>
        <to usec="0" sec="1628399628"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54555,1.49129,010,0 0 0 1 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.78" dst_port="443"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.78" dst_port="80"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399448"/>
    </anomaly>
    <anomaly type="anomalous" value="2.00618,1.62244,504,0 0 0 0 0 0 1 1 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="17.217.12.249" dst_ip="203.109.255.227" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.29442,2.95445,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICecrqICecrqdurmterp">
        <slice>
            <filter dst_ip="203.109.241.54"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399251"/>
    </anomaly>
    <anomaly type="anomalous" value="3.45555,2.98212,011,0 0 0 1 1 0 1 0 1 1 1 0,heavy_hitter">
        <slice>
            <filter src_ip="203.109.255.44" dst_ip="91.23.225.196" dst_port="58604"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,010,0 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.150" dst_port="443"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.150" dst_port="80"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.254.229.158" dst_port="53"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="199.12.193.236" dst_ip="133.196.95.71" dst_port="1081"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="35.72.12.61"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="202.254.240.154" dst_ip="3.241.139.57" dst_port="53"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.196.95.58" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="2.00618,1.62244,504,0 0 0 0 0 0 1 1 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="203.109.255.90" dst_ip="52.63.72.55" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,010,0 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.208" dst_port="80"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.208" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,999,0 0 0 0 0 0 1 1 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="131.110.15.31" dst_ip="68.151.19.111" src_port="53"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="3.29442,2.95445,011,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="203.109.255.44" dst_ip="91.23.225.196" dst_port="58604"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="54.210.6.189"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,010,0 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.207" dst_port="443"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.207" dst_port="80"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,010,0 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="71.186.177.104" dst_ip="202.102.149.132" dst_port="443"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.149.132" dst_port="80"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.109.240.130" dst_ip="73.115.8.125" dst_port="6090"/>
            <filter src_ip="203.109.240.130" dst_ip="73.115.8.125" dst_port="1805"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.109.244.184" dst_ip="216.18.144.96" dst_port="53"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.71453,1.51431,504,0 0 0 0 0 0 1 1 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="17.13.196.88" dst_ip="203.109.255.227" src_port="443"/>
            <filter src_ip="17.13.196.88" dst_ip="163.217.81.153" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,999,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.109.240.130" dst_ip="172.24.243.170" dst_port="37646"/>
            <filter src_ip="203.109.240.130" dst_ip="172.24.243.170" dst_port="29292"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54555,1.49129,010,0 0 0 1 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="71.186.177.104" dst_ip="202.102.149.181" dst_port="80"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.149.181" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399533"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,010,0 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="71.186.177.104" dst_ip="202.102.149.190" dst_port="80"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.149.190" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,010,0 0 0 0 0 0 1 1 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="71.186.177.104" dst_ip="202.102.149.224" dst_port="443"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.149.224" dst_port="80"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.71453,1.51431,010,0 0 0 0 0 0 1 1 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="144.217.28.92" dst_ip="202.102.144.38"/>
            <filter src_ip="144.217.28.92" dst_port="80"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.38" dst_port="80"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.38" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,999,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.109.240.62" dst_port="443"/>
            <filter dst_ip="203.109.240.62" dst_port="80"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="3.19.200.228"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="170.20.180.207" dst_ip="202.102.144.30" dst_port="9362"/>
            <filter src_ip="170.20.180.216" dst_ip="202.102.144.30" dst_port="6000"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="34.32.247.3"/>
        </slice>
        <from usec="0" sec="1628399115"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="anomalous" value="3.78794,3.16653,504,0 0 0 0 0 0 1 1 1 1 1 1,ptmpla">
        <slice>
            <filter src_ip="203.109.255.90" dst_ip="13.157.203.55" dst_port="443"/>
            <filter src_ip="203.109.255.90" dst_ip="52.197.218.45" dst_port="443"/>
            <filter src_ip="203.109.255.90" dst_ip="52.63.72.55" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,010,0 0 0 0 0 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="133.196.95.67" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1628399115"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.109.244.190" dst_port="53"/>
        </slice>
        <from usec="0" sec="1628399115"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.109.255.54" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1628399115"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4257,1.87673,999,0 0 0 1 0 0 1 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.109.255.44" dst_port="30303"/>
            <filter src_ip="67.49.201.191" dst_ip="203.109.255.44" src_port="32766"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.29442,2.95445,011,0 0 0 0 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="203.109.255.44" dst_ip="91.23.225.194" dst_port="59128"/>
        </slice>
        <from usec="0" sec="1628399115"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="54.85.227.0"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="130.186.86.210" dst_ip="201.131.133.234" src_port="53"/>
            <filter src_ip="157.210.173.108" dst_ip="201.131.133.234" src_port="53"/>
        </slice>
        <from usec="0" sec="1628399115"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,020,0 0 0 0 0 0 1 1 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="54.128.147.62"/>
        </slice>
        <from usec="0" sec="1628399115"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="anomalous" value="3.29442,2.95445,999,0 0 0 0 0 0 1 1 1 0 0 0,alphfl">
        <slice>
            <filter src_ip="203.109.240.130" dst_ip="68.58.251.97" dst_port="15336"/>
            <filter src_ip="203.109.240.130" dst_ip="68.58.251.97" dst_port="26921"/>
            <filter src_ip="203.109.240.130" dst_ip="68.58.251.97" dst_port="15622"/>
            <filter src_ip="203.109.240.130" dst_ip="68.58.251.97" dst_port="6749"/>
        </slice>
        <from usec="0" sec="1628399115"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,011,0 0 0 0 0 0 1 1 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="203.109.255.44" dst_ip="91.23.225.196" dst_port="58604"/>
        </slice>
        <from usec="0" sec="1628399475"/>
        <to usec="0" sec="1628399521"/>
    </anomaly>
    <anomaly type="anomalous" value="1.54555,1.49129,999,0 0 0 1 0 0 1 1 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="202.102.144.7"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.19" dst_port="80"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399358"/>
    </anomaly>
    <anomaly type="anomalous" value="1.9192,1.64045,999,0 0 0 1 1 0 1 1 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="117.218.176.78"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92198,1.59606,010,0 0 0 1 0 0 0 0 0 1 1 1,sntscSYN">
        <slice>
            <filter src_ip="138.59.52.253" dst_port="6379"/>
            <filter src_ip="138.59.52.253" dst_port="6380"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.30842,2.77045,010,0 0 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="167.24.133.33"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55788,1.49435,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="210.66.132.235" dst_ip="203.109.244.160" dst_port="53"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="anomalous" value="3.30842,2.77045,010,0 0 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="167.130.153.233" src_port="58094"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92198,1.59606,504,0 0 0 1 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="202.244.218.155" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.49318,1.48577,504,1 0 0 0 0 0 0 0 0 0 0 1,ptmp">
        <slice>
            <filter src_ip="202.244.217.94" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34034,1.28391,503,0 0 0 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="202.254.235.165" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92198,1.59606,504,0 0 0 1 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.109.249.232" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.94656,1.6117,503,1 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="203.109.252.191" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.18805,2.69598,504,0 0 0 1 0 1 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="163.217.179.250" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92198,1.59606,503,0 0 0 1 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="203.109.252.191" dst_ip="118.94.107.53" src_port="80" dst_port="41564"/>
            <filter src_ip="203.109.252.191" dst_ip="118.94.107.53" src_port="80" dst_port="41560"/>
            <filter src_ip="203.109.252.191" dst_ip="118.94.107.53" src_port="80" dst_port="41558"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92198,1.59606,504,0 0 0 1 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="202.244.220.245" src_port="22"/>
            <filter src_ip="202.244.220.245" dst_ip="126.19.102.184" src_port="443"/>
            <filter src_ip="202.244.220.245" dst_ip="60.153.186.20" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.93191,1.59892,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="163.217.12.138" src_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92198,1.59606,503,0 0 0 1 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="203.109.252.191" dst_ip="126.179.80.171" src_port="80" dst_port="52838"/>
            <filter src_ip="203.109.252.191" dst_ip="126.179.80.171" src_port="80" dst_port="52612"/>
            <filter src_ip="203.109.252.191" dst_ip="126.179.80.171" src_port="80" dst_port="52408"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.11565,1.71887,999,0 0 0 1 1 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.109.245.8" dst_ip="128.225.1.145"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.93191,1.59892,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="163.217.80.42" dst_ip="13.139.245.235" dst_port="443"/>
            <filter src_ip="163.217.176.52" dst_ip="13.139.245.235" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92198,1.59606,504,0 0 0 1 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="163.217.129.92" dst_ip="13.30.34.227" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34034,1.28391,010,0 0 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="109.110.91.210" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92198,1.59606,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.217.83.224" src_port="443"/>
            <filter dst_ip="163.217.83.224" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.93191,1.59892,999,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="191.102.70.211" dst_ip="163.217.195.16" src_port="27240" dst_port="52318"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.37535,1.3033,503,1 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="163.217.240.69"/>
            <filter src_ip="71.199.117.203" src_port="50880" dst_port="50880"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35454,1.28747,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="104.154.249.225" dst_ip="163.217.132.185" src_port="443"/>
            <filter src_ip="104.154.249.225" dst_ip="163.217.132.185" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.43773,1.349,010,1 1 0 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="122.62.143.26" dst_port="5555"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.4257,1.87673,503,0 0 0 1 0 0 1 1 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.109.252.191" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.38919,1.30681,503,1 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="153.2.153.117" dst_port="53"/>
            <filter src_ip="153.2.153.117" dst_ip="203.109.245.175" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.37535,1.3033,503,1 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.109.252.191" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.11565,1.71887,504,0 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="162.29.38.121" src_port="443"/>
            <filter src_ip="31.54.171.61" dst_ip="163.217.161.109" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92198,1.59606,999,0 0 0 1 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="163.217.195.16" dst_ip="191.102.70.211" src_port="52318" dst_port="27240"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35454,1.28747,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="172.66.234.41" dst_ip="163.217.129.67" src_port="443" dst_port="58932"/>
            <filter src_ip="172.66.234.41" dst_ip="163.217.129.67" src_port="443" dst_port="58931"/>
            <filter src_ip="172.66.234.41" dst_ip="163.217.129.67" src_port="443" dst_port="51423"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35454,1.28747,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.244.217.94" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.38919,1.30681,999,1 0 0 0 0 0 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="204.98.94.36" dst_ip="203.109.245.8"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35454,1.28747,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="213.195.200.153" dst_ip="203.109.252.191" src_port="47942" dst_port="80"/>
            <filter src_ip="213.195.200.153" dst_ip="203.109.252.191" src_port="47932" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.93191,1.59892,999,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="213.226.53.158" dst_ip="163.217.80.72" src_port="5938" dst_port="63055"/>
            <filter src_ip="213.226.53.158" dst_ip="163.217.226.178" src_port="5938" dst_port="61615"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35454,1.28747,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="23.29.210.121" dst_ip="163.217.81.196" src_port="443"/>
            <filter src_ip="23.29.210.121" dst_ip="163.217.128.47" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.50636,2.89109,504,1 0 0 1 1 1 0 1 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.217.240.73" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35454,1.28747,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="45.209.203.11" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35454,1.28747,020,0 0 0 0 0 0 0 0 0 1 1 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="120.39.159.65"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35454,1.28747,010,0 0 0 0 0 0 0 0 0 1 1 0,poscaSYN">
        <slice>
            <filter src_ip="147.187.8.192" dst_ip="133.117.3.76" src_port="32766"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34034,1.28391,504,0 0 0 1 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="163.217.132.181" dst_ip="140.183.3.66" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34034,1.28391,999,0 0 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.217.12.138" dst_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92198,1.59606,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.217.83.25" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35454,1.28747,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.217.82.182" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.92198,1.59606,504,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.217.82.179" src_port="443"/>
            <filter dst_ip="163.217.80.242" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.6152,1.48601,504,0 0 0 1 0 0 0 0 0 1 0 1,mptmp">
        <slice>
            <filter dst_ip="203.109.226.99"/>
            <filter dst_ip="163.217.224.136" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.15978,2.66801,504,0 0 0 1 1 1 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="117.34.242.252" dst_ip="163.217.240.73"/>
            <filter src_ip="117.34.242.252" src_port="80"/>
            <filter dst_ip="163.217.240.73" src_port="80"/>
            <filter dst_ip="163.217.240.73" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35454,1.28747,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="163.217.11.38" dst_ip="18.98.12.97" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34034,1.28391,503,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="45.159.47.160" dst_ip="203.109.245.175"/>
            <filter src_ip="45.159.47.160" dst_ip="203.109.252.191"/>
            <filter src_ip="45.159.47.160" dst_port="80"/>
            <filter src_ip="158.27.152.115" dst_ip="203.109.245.175"/>
            <filter src_ip="158.27.152.115" dst_ip="203.109.252.191"/>
            <filter src_ip="158.27.152.115" dst_port="80"/>
            <filter dst_ip="203.109.245.175" dst_port="80"/>
            <filter dst_ip="203.109.252.191" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.93191,1.59892,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="13.157.203.55" dst_ip="203.109.255.90" src_port="443"/>
            <filter src_ip="52.197.218.45" dst_ip="203.109.255.90" src_port="443"/>
            <filter src_ip="52.63.72.55" dst_ip="203.109.255.90" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35454,1.28747,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="163.217.81.114" dst_ip="47.26.252.82" src_port="59661" dst_port="443"/>
            <filter src_ip="163.217.81.114" dst_ip="47.26.252.82" src_port="59658" dst_port="443"/>
            <filter src_ip="163.217.81.114" dst_ip="47.26.252.82" src_port="56221" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.93191,1.59892,504,0 0 0 0 0 0 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="163.217.83.224" dst_ip="47.26.252.20" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35454,1.28747,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="163.217.11.38" dst_ip="54.233.1.171" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.93191,1.59892,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.217.81.36" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.95636,1.61454,504,1 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.217.132.181" src_port="443"/>
            <filter src_ip="54.65.63.198" dst_ip="163.217.132.181" src_port="3478"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.93191,1.59892,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="143.48.170.158" dst_ip="163.217.129.92" src_port="443" dst_port="12200"/>
            <filter src_ip="143.48.170.158" dst_ip="163.217.129.92" src_port="443" dst_port="1638"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.78794,3.16653,503,0 0 0 0 0 0 1 1 1 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="203.109.252.191" dst_port="80"/>
            <filter dst_ip="203.109.252.191"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.93191,1.59892,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="162.29.111.142" dst_ip="163.217.229.177" src_port="443" dst_port="40667"/>
            <filter src_ip="162.29.111.142" dst_ip="163.217.83.119" src_port="443" dst_port="64053"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.93191,1.59892,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="18.190.62.86" dst_ip="163.217.179.30" src_port="443" dst_port="64757"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35454,1.28747,504,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="163.217.83.8"/>
            <filter src_ip="162.29.38.121" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.35454,1.28747,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter dst_ip="163.217.195.8" src_port="443"/>
            <filter dst_ip="163.217.195.8" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.34034,1.28391,503,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="45.205.207.175" dst_ip="203.109.245.175"/>
            <filter src_ip="45.205.207.175" dst_ip="203.109.252.191"/>
            <filter src_ip="45.205.207.175" dst_port="80"/>
            <filter src_ip="45.159.146.214" dst_ip="203.109.245.175"/>
            <filter src_ip="45.159.146.214" dst_ip="203.109.252.191"/>
            <filter src_ip="45.159.146.214" dst_port="80"/>
            <filter dst_ip="203.109.245.175" dst_port="80"/>
            <filter dst_ip="203.109.252.191" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990915,1.21681,504,1 1 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="126.43.94.114" dst_ip="203.109.225.65" src_port="62305" dst_port="443"/>
            <filter src_ip="126.43.94.114" dst_ip="203.109.225.65" src_port="59876" dst_port="443"/>
            <filter src_ip="126.43.94.114" dst_ip="203.109.225.104" src_port="63981" dst_port="8443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919082,1.16986,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="126.179.80.171" dst_ip="203.109.252.191" src_port="52838" dst_port="80"/>
            <filter src_ip="126.179.80.171" dst_ip="203.109.252.191" src_port="52612" dst_port="80"/>
            <filter src_ip="126.179.80.171" dst_ip="203.109.252.191" src_port="52408" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="89.228.228.56" dst_port="445"/>
        </slice>
        <from usec="0" sec="1628398858"/>
        <to usec="0" sec="1628398859"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="170.235.130.247" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398973"/>
        <to usec="0" sec="1628398984"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="45.64.85.104" src_port="3243" dst_port="5555"/>
            <filter src_ip="45.64.85.104" src_port="3206" dst_port="5555"/>
            <filter src_ip="45.64.85.104" src_port="3185" dst_port="5555"/>
            <filter src_ip="45.64.85.104" src_port="3262" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398963"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="183.159.55.244" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398965"/>
        <to usec="0" sec="1628398977"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="59.140.82.246" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398960"/>
        <to usec="0" sec="1628398965"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="49.77.104.117" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398969"/>
        <to usec="0" sec="1628398978"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="14.64.63.22" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398966"/>
        <to usec="0" sec="1628398979"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="175.74.254.116" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398962"/>
        <to usec="0" sec="1628398974"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="147.221.235.23" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398940"/>
        <to usec="0" sec="1628398951"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="111.173.137.12" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398927"/>
        <to usec="0" sec="1628398938"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="199.186.92.142" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398961"/>
        <to usec="0" sec="1628398972"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.249.145.98" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398971"/>
        <to usec="0" sec="1628398982"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="5.205.175.15" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398964"/>
        <to usec="0" sec="1628398975"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="112.70.45.28" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398957"/>
        <to usec="0" sec="1628398971"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="41.210.33.9" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398990"/>
        <to usec="0" sec="1628399001"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.8.127.21" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1628399389"/>
        <to usec="0" sec="1628399390"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="103.31.5.22" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398963"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="191.161.170.149" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398965"/>
        <to usec="0" sec="1628398978"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="95.172.249.13" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398992"/>
        <to usec="0" sec="1628399003"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="117.162.39.29" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398959"/>
        <to usec="0" sec="1628398978"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="103.215.180.226" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398961"/>
        <to usec="0" sec="1628398974"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15049,1.31627,010,1 1 1 0 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.19.116.238" dst_port="5555"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="112.93.183.220" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398973"/>
        <to usec="0" sec="1628398986"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="49.236.192.217" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398974"/>
        <to usec="0" sec="1628398988"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="95.187.176.216" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398963"/>
        <to usec="0" sec="1628398974"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="112.240.83.171" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398957"/>
        <to usec="0" sec="1628398971"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="185.147.196.212" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398962"/>
        <to usec="0" sec="1628398975"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="27.195.59.81" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398965"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="186.45.156.190" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398956"/>
        <to usec="0" sec="1628398968"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="46.197.52.205" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398964"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="117.162.37.70" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398976"/>
        <to usec="0" sec="1628398987"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="117.162.37.71" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398954"/>
        <to usec="0" sec="1628398965"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="121.70.108.76" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398974"/>
        <to usec="0" sec="1628398987"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="175.50.112.194" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398967"/>
        <to usec="0" sec="1628398980"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="179.165.152.182" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398959"/>
        <to usec="0" sec="1628398972"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="122.31.230.186" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398953"/>
        <to usec="0" sec="1628398964"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="61.54.185.180" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398954"/>
        <to usec="0" sec="1628398966"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="99.234.93.76" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398968"/>
        <to usec="0" sec="1628398981"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.202.39.205" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398956"/>
        <to usec="0" sec="1628398969"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="61.39.128.204" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398962"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="38.45.37.65" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398947"/>
        <to usec="0" sec="1628398960"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.189.103.156" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398957"/>
        <to usec="0" sec="1628398970"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="212.146.159.162" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398967"/>
        <to usec="0" sec="1628398978"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="31.202.109.2" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398957"/>
        <to usec="0" sec="1628398970"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="190.72.215.251" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398964"/>
        <to usec="0" sec="1628398977"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.211.150.155" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398968"/>
        <to usec="0" sec="1628398981"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="112.101.111.250" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398961"/>
        <to usec="0" sec="1628398974"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="84.244.122.185" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398967"/>
        <to usec="0" sec="1628398975"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="131.161.220.146" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398967"/>
        <to usec="0" sec="1628398975"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="190.73.41.179" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398976"/>
        <to usec="0" sec="1628398986"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="157.251.115.140" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628399018"/>
        <to usec="0" sec="1628399031"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.8.117.49" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398940"/>
        <to usec="0" sec="1628398955"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="117.135.143.78" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398963"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="91.19.166.254" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398975"/>
        <to usec="0" sec="1628398988"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="116.13.163.84" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1628399222"/>
        <to usec="0" sec="1628399224"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="89.237.219.96" dst_port="445"/>
        </slice>
        <from usec="0" sec="1628399323"/>
        <to usec="0" sec="1628399324"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="143.125.252.239" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398984"/>
        <to usec="0" sec="1628398995"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="125.62.163.26" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1628399346"/>
        <to usec="0" sec="1628399348"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="91.16.76.59" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1628398835"/>
        <to usec="0" sec="1628399647"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="101.248.154.151" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398962"/>
        <to usec="0" sec="1628398975"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="120.90.184.113" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628399026"/>
        <to usec="0" sec="1628399039"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="183.225.34.208" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1628399226"/>
        <to usec="0" sec="1628399228"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="101.99.172.207" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398961"/>
        <to usec="0" sec="1628398972"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="111.191.167.28" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1628399019"/>
        <to usec="0" sec="1628399021"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="159.255.100.35" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398967"/>
        <to usec="0" sec="1628398979"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="98.59.115.165" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398938"/>
        <to usec="0" sec="1628398951"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.216.18.154" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398969"/>
        <to usec="0" sec="1628398982"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="211.63.98.224" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398981"/>
        <to usec="0" sec="1628398994"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.167.15.213" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398985"/>
        <to usec="0" sec="1628398999"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="117.162.39.85" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398961"/>
        <to usec="0" sec="1628398972"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="125.121.210.147" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628399400"/>
        <to usec="0" sec="1628399413"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="97.230.70.2" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398971"/>
        <to usec="0" sec="1628398984"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="202.39.63.206" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1628399575"/>
        <to usec="0" sec="1628399576"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="61.54.242.134" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398968"/>
        <to usec="0" sec="1628398977"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="112.58.161.52" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628399058"/>
        <to usec="0" sec="1628399072"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="14.64.140.132" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398966"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="77.232.127.52" dst_port="445"/>
        </slice>
        <from usec="0" sec="1628399048"/>
        <to usec="0" sec="1628399050"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="94.247.169.119" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398958"/>
        <to usec="0" sec="1628398971"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="67.9.35.66" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398960"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="119.58.163.140" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398972"/>
        <to usec="0" sec="1628398989"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="45.118.164.78" dst_port="22"/>
        </slice>
        <from usec="0" sec="1628398981"/>
        <to usec="0" sec="1628398992"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="191.163.19.96" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398963"/>
        <to usec="0" sec="1628398974"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="90.180.205.135" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398965"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="87.146.151.100" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398965"/>
        <to usec="0" sec="1628398978"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="183.151.180.126" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398963"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.164.241.152" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398963"/>
        <to usec="0" sec="1628398974"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="152.21.184.149" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398963"/>
        <to usec="0" sec="1628398982"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="31.156.144.108" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398959"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="46.245.87.142" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398938"/>
        <to usec="0" sec="1628398951"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="73.216.31.114" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398990"/>
        <to usec="0" sec="1628399000"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="187.38.58.108" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398960"/>
        <to usec="0" sec="1628398975"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="91.20.1.135" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398956"/>
        <to usec="0" sec="1628398969"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="121.99.247.133" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398963"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="171.42.208.100" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398964"/>
        <to usec="0" sec="1628398972"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="59.151.61.157" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1628399009"/>
        <to usec="0" sec="1628399010"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.167.111.156" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398960"/>
        <to usec="0" sec="1628398973"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="217.37.206.115" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398978"/>
        <to usec="0" sec="1628398991"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="31.59.118.109" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398978"/>
        <to usec="0" sec="1628398986"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="69.49.91.128" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398958"/>
        <to usec="0" sec="1628398969"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="117.162.37.165" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398955"/>
        <to usec="0" sec="1628398967"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="76.147.9.163" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398936"/>
        <to usec="0" sec="1628398949"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="129.53.150.164" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398970"/>
        <to usec="0" sec="1628398983"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="117.162.39.165" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398948"/>
        <to usec="0" sec="1628398959"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="172.85.205.170" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398964"/>
        <to usec="0" sec="1628398981"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="111.0.24.170" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398966"/>
        <to usec="0" sec="1628398979"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="111.191.136.67" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398967"/>
        <to usec="0" sec="1628398980"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.206.90.68" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398962"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="190.56.44.181" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398963"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="118.201.188.70" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398958"/>
        <to usec="0" sec="1628398971"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="121.59.106.79" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1628399093"/>
        <to usec="0" sec="1628399102"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="211.199.233.183" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398956"/>
        <to usec="0" sec="1628398969"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="91.42.220.185" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398956"/>
        <to usec="0" sec="1628398967"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="94.255.85.188" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398935"/>
        <to usec="0" sec="1628398947"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990915,1.21681,010,1 1 0 0 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="90.224.26.5" dst_port="5555"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="183.220.188.228" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398971"/>
        <to usec="0" sec="1628398985"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="178.177.253.195" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398982"/>
        <to usec="0" sec="1628398993"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="171.137.36.53" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1628399486"/>
        <to usec="0" sec="1628399487"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="123.192.252.22" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398988"/>
        <to usec="0" sec="1628398999"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="24.235.54.22" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398957"/>
        <to usec="0" sec="1628398973"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="106.182.100.214" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398802"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="190.201.83.50" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398974"/>
        <to usec="0" sec="1628398987"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="211.27.30.12" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398965"/>
        <to usec="0" sec="1628398978"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="84.209.6.52" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398958"/>
        <to usec="0" sec="1628398969"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="142.8.55.235" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398977"/>
        <to usec="0" sec="1628398988"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="27.195.68.45" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398964"/>
        <to usec="0" sec="1628398977"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="74.21.89.246" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398965"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="211.27.242.3" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398932"/>
        <to usec="0" sec="1628398946"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.216.192.21" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628399000"/>
        <to usec="0" sec="1628399013"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="185.173.84.57" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1628398855"/>
        <to usec="0" sec="1628398857"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="184.97.71.52" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398955"/>
        <to usec="0" sec="1628398966"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="79.79.154.50" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398977"/>
        <to usec="0" sec="1628398990"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.237.143.253" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398965"/>
        <to usec="0" sec="1628398986"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="212.30.120.221" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398938"/>
        <to usec="0" sec="1628398965"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="223.114.194.61" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398984"/>
        <to usec="0" sec="1628398997"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="188.115.202.39" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398956"/>
        <to usec="0" sec="1628398968"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="108.78.120.22" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398945"/>
        <to usec="0" sec="1628398977"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="186.85.189.236" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628399188"/>
        <to usec="0" sec="1628399205"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="88.39.57.199" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398962"/>
        <to usec="0" sec="1628398975"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="190.44.70.55" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398897"/>
        <to usec="0" sec="1628398944"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="68.78.196.196" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398962"/>
        <to usec="0" sec="1628398975"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="186.43.229.248" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398960"/>
        <to usec="0" sec="1628398971"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.33.2.13" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1628398903"/>
        <to usec="0" sec="1628399654"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.33.2.11" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1628399128"/>
        <to usec="0" sec="1628399580"/>
    </anomaly>
    <anomaly type="suspicious" value="1.36304,1.41511,010,1 1 1 1 0 0 0 0 0 0 1 0,ptmp">
        <slice>
            <filter src_ip="185.114.236.35"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="177.144.245.246" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628399064"/>
        <to usec="0" sec="1628399077"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="182.150.187.201" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398970"/>
        <to usec="0" sec="1628398983"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="116.52.187.63" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398966"/>
        <to usec="0" sec="1628398973"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="211.27.30.59" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398967"/>
        <to usec="0" sec="1628398980"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="46.200.28.8" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398944"/>
        <to usec="0" sec="1628398957"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="118.196.183.54" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398964"/>
        <to usec="0" sec="1628398977"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="218.216.1.4" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398940"/>
        <to usec="0" sec="1628398944"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="118.87.169.194" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398965"/>
        <to usec="0" sec="1628398978"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="150.242.120.134" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398957"/>
        <to usec="0" sec="1628398968"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="5.198.16.12" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398956"/>
        <to usec="0" sec="1628398967"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="210.245.57.71" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398960"/>
        <to usec="0" sec="1628398975"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="173.202.122.155" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398963"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.208.146.248" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398962"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="71.79.120.128" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398983"/>
        <to usec="0" sec="1628398994"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="125.224.158.155" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398969"/>
        <to usec="0" sec="1628398984"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="111.164.81.138" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1628399298"/>
        <to usec="0" sec="1628399299"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="86.222.250.139" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1628399389"/>
        <to usec="0" sec="1628399396"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="185.142.197.4" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1628399386"/>
        <to usec="0" sec="1628399390"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.204.74.167" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398959"/>
        <to usec="0" sec="1628398972"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="176.13.43.194" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398935"/>
        <to usec="0" sec="1628398953"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="185.113.52.212" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398949"/>
        <to usec="0" sec="1628398972"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="118.95.184.242" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628399088"/>
        <to usec="0" sec="1628399102"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="95.151.237.111" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398962"/>
        <to usec="0" sec="1628398978"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="117.162.35.16" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398953"/>
        <to usec="0" sec="1628398966"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="183.150.168.140" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398966"/>
        <to usec="0" sec="1628398979"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.210.170.170" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398959"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="118.95.77.81" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398959"/>
        <to usec="0" sec="1628398977"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="187.137.52.158" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398965"/>
        <to usec="0" sec="1628398978"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="37.144.38.162" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398928"/>
        <to usec="0" sec="1628398936"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="173.202.238.38" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628399158"/>
        <to usec="0" sec="1628399171"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="121.123.75.105" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398957"/>
        <to usec="0" sec="1628398970"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="209.204.150.84" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398941"/>
        <to usec="0" sec="1628398954"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="173.64.193.81" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398950"/>
        <to usec="0" sec="1628398959"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="199.205.160.16" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398945"/>
        <to usec="0" sec="1628398958"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="78.215.162.185" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628399389"/>
        <to usec="0" sec="1628399401"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="183.37.87.129" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398928"/>
        <to usec="0" sec="1628398939"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.208.107.123" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398980"/>
        <to usec="0" sec="1628398993"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="46.187.250.124" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398961"/>
        <to usec="0" sec="1628398969"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="121.69.71.146" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398956"/>
        <to usec="0" sec="1628398967"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="176.153.152.112" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398980"/>
        <to usec="0" sec="1628398993"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="80.39.144.131" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398960"/>
        <to usec="0" sec="1628398973"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="181.23.52.120" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398963"/>
        <to usec="0" sec="1628398980"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="82.61.180.95" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398958"/>
        <to usec="0" sec="1628398973"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="97.216.155.161" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398961"/>
        <to usec="0" sec="1628398977"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="76.73.187.85" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398944"/>
        <to usec="0" sec="1628398951"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.204.73.173" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398960"/>
        <to usec="0" sec="1628398973"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="190.45.182.83" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398960"/>
        <to usec="0" sec="1628398975"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="110.65.227.172" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398963"/>
        <to usec="0" sec="1628398978"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="112.73.97.173" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398966"/>
        <to usec="0" sec="1628398977"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="124.213.24.72" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398943"/>
        <to usec="0" sec="1628398954"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="92.225.105.186" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398958"/>
        <to usec="0" sec="1628398969"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.237.143.183" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398959"/>
        <to usec="0" sec="1628398974"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.31.120.79" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398962"/>
        <to usec="0" sec="1628398975"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15049,1.31627,010,1 1 1 0 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="177.139.18.62" dst_port="5555"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,999,1 1 1 0 0 0 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="211.33.150.1" dst_ip="202.102.145.125" dst_port="8291"/>
        </slice>
        <from usec="0" sec="1628399592"/>
        <to usec="0" sec="1628399620"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.222.236.239" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398967"/>
        <to usec="0" sec="1628398980"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="116.95.147.61" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398935"/>
        <to usec="0" sec="1628398949"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="92.202.229.199" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398978"/>
        <to usec="0" sec="1628398991"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="1.178.127.218" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398964"/>
        <to usec="0" sec="1628398977"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="183.24.23.25" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398964"/>
        <to usec="0" sec="1628398977"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="186.58.252.224" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398964"/>
        <to usec="0" sec="1628398977"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="207.57.49.23" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398982"/>
        <to usec="0" sec="1628398993"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="211.31.69.238" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398934"/>
        <to usec="0" sec="1628398947"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="175.74.146.17" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628399098"/>
        <to usec="0" sec="1628399112"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="36.103.140.9" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398936"/>
        <to usec="0" sec="1628398950"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="211.27.30.54" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398963"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="82.24.94.243" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398997"/>
        <to usec="0" sec="1628399008"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.33.2.10" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1628398981"/>
        <to usec="0" sec="1628399516"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="69.172.144.5" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398961"/>
        <to usec="0" sec="1628398973"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="121.235.154.2" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1628399536"/>
        <to usec="0" sec="1628399691"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="205.78.168.222" src_port="22" dst_port="49714"/>
        </slice>
        <from usec="0" sec="1628399381"/>
        <to usec="0" sec="1628399383"/>
    </anomaly>
    <anomaly type="suspicious" value="0.971415,1.21305,010,1 1 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="59.224.199.231" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.10135,1.34853,999,1 1 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="199.12.193.236" dst_ip="133.196.95.83" dst_port="1072"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87905,1.28972,999,1 1 1 1 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.33.2.12" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1628398803"/>
        <to usec="0" sec="1628398908"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919082,1.16986,504,1 0 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="163.217.225.9" dst_ip="47.26.252.30"/>
            <filter src_ip="163.217.225.9" dst_port="443"/>
            <filter src_ip="163.217.83.224" dst_ip="47.26.252.30" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22202,1.3101,504,0 0 0 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="163.217.195.17" dst_port="443"/>
            <filter dst_ip="18.101.75.83" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="183.37.87.40" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398955"/>
        <to usec="0" sec="1628398966"/>
    </anomaly>
    <anomaly type="suspicious" value="1.24687,1.43891,010,1 1 1 1 1 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.9.187.172" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398803"/>
        <to usec="0" sec="1628399621"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,020,0 0 0 1 1 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="18.110.165.190"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398906"/>
    </anomaly>
    <anomaly type="suspicious" value="1.26032,1.32911,010,1 0 0 1 1 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="167.24.133.45"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.217.132.32" dst_ip="54.158.201.33" src_port="443" dst_port="53549"/>
            <filter src_ip="163.217.132.32" dst_ip="54.158.201.33" src_port="443" dst_port="24438"/>
            <filter src_ip="163.217.132.32" dst_ip="192.30.72.95" src_port="80" dst_port="34200"/>
            <filter src_ip="163.217.132.32" dst_ip="123.149.255.14" src_port="443" dst_port="64160"/>
        </slice>
        <from usec="0" sec="1628398804"/>
        <to usec="0" sec="1628398979"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,020,0 0 0 1 0 0 0 0 0 1 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="113.19.203.219"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.898023,1.16595,504,1 0 0 1 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.217.176.52" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06528,1.26138,999,0 0 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="74.23.240.199"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.13" dst_port="80"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398984"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87905,1.28972,010,1 1 1 1 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="221.89.105.217" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398801"/>
        <to usec="0" sec="1628399084"/>
    </anomaly>
    <anomaly type="suspicious" value="1.11858,1.35192,504,1 1 0 0 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.196.252.160" dst_ip="163.217.92.211" src_port="443"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399628"/>
    </anomaly>
    <anomaly type="suspicious" value="1.13374,1.31279,010,1 1 1 1 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="220.201.81.112" dst_port="5555"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87905,1.28972,010,1 1 1 1 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="47.178.184.252" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398804"/>
        <to usec="0" sec="1628399356"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87905,1.28972,010,1 1 1 1 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="130.209.33.210" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398818"/>
        <to usec="0" sec="1628399088"/>
    </anomaly>
    <anomaly type="suspicious" value="1.44784,1.46567,010,0 0 0 1 0 0 0 0 0 0 0 1,mptp">
        <slice>
            <filter dst_ip="89.0.61.105"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87905,1.28972,010,1 1 1 1 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="74.23.240.241"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399448"/>
    </anomaly>
    <anomaly type="suspicious" value="1.44784,1.46567,504,0 0 0 1 0 0 0 0 0 0 0 1,mptmp">
        <slice>
            <filter src_ip="192.5.232.232" src_port="443"/>
            <filter dst_ip="163.217.161.183" src_port="443"/>
            <filter dst_ip="163.217.82.173" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="62.214.227.226" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398939"/>
        <to usec="0" sec="1628398950"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990915,1.21681,010,1 1 0 0 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="77.47.172.139" dst_port="5555"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.43782,1.45963,504,1 1 1 1 1 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="163.217.129.92" dst_ip="99.88.208.254" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22202,1.3101,010,0 0 0 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="202.102.149.213" src_port="80"/>
            <filter dst_ip="71.186.177.104" src_port="80"/>
            <filter src_ip="202.102.149.213" dst_ip="71.186.177.104" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="5.100.227.10" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398962"/>
        <to usec="0" sec="1628398974"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="45.108.59.194" dst_port="8080"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399088"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87905,1.28972,010,1 1 1 1 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="74.23.240.147" dst_port="8291"/>
            <filter src_ip="74.23.240.147" dst_port="8728"/>
            <filter src_ip="74.23.240.147" dst_port="22"/>
        </slice>
        <from usec="0" sec="1628398804"/>
        <to usec="0" sec="1628399356"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87905,1.28972,010,1 1 1 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="101.99.130.82" dst_port="5555"/>
            <filter src_ip="139.147.61.222" dst_port="23"/>
        </slice>
        <from usec="0" sec="1628398807"/>
        <to usec="0" sec="1628399357"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="107.109.183.134" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398992"/>
        <to usec="0" sec="1628399003"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="183.159.18.240" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398957"/>
        <to usec="0" sec="1628398976"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="175.74.220.152" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398973"/>
        <to usec="0" sec="1628398986"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="163.217.195.87" dst_port="443"/>
            <filter dst_ip="20.12.80.102" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399533"/>
    </anomaly>
    <anomaly type="suspicious" value="0.898023,1.16595,999,1 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="54.71.203.97" dst_ip="163.217.174.52"/>
            <filter src_ip="54.71.203.97" dst_ip="163.217.174.49"/>
            <filter src_ip="54.71.203.97" src_port="3478"/>
            <filter src_ip="54.130.89.182" dst_ip="163.217.174.52"/>
            <filter src_ip="54.130.89.182" src_port="5802"/>
            <filter dst_ip="163.217.174.52" src_port="3478"/>
            <filter dst_ip="163.217.174.52" src_port="5802"/>
            <filter dst_ip="163.217.174.49" src_port="3478"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,010,0 0 0 1 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="157.218.161.39" src_port="48439" dst_port="3306"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.30722,1.41607,010,1 1 1 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="167.24.133.32"/>
            <filter src_ip="106.143.30.124" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399626"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,010,0 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="162.138.146.223"/>
            <filter dst_ip="74.23.240.213"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="72.117.15.33" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398955"/>
        <to usec="0" sec="1628398969"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87905,1.28972,010,1 1 1 1 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="162.216.68.15" src_port="32767" dst_port="8545"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="203.109.240.145" dst_port="443"/>
            <filter dst_ip="52.56.120.10" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,503,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="124.215.54.240" dst_ip="163.217.161.183"/>
            <filter src_ip="124.215.54.240" src_port="443"/>
            <filter src_ip="124.215.54.240" src_port="80"/>
            <filter dst_ip="163.217.161.183" src_port="443"/>
            <filter dst_ip="163.217.161.183" src_port="80"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399177"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,503,0 0 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="38.83.103.167" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="14.77.161.111" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628399116"/>
        <to usec="0" sec="1628399129"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,503,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="163.217.57.118" src_port="80"/>
        </slice>
        <from usec="0" sec="1628398801"/>
        <to usec="0" sec="1628399537"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87905,1.28972,010,1 1 1 1 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="37.123.7.221" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398831"/>
        <to usec="0" sec="1628399425"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,010,0 0 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="167.130.153.196" src_port="58034"/>
            <filter src_ip="167.130.153.196" src_port="58691"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.13374,1.31279,010,1 1 1 1 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.209.224.155" dst_port="5555"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,999,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="203.109.244.177"/>
            <filter dst_ip="203.90.147.241"/>
            <filter dst_ip="205.78.161.155" src_port="22"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="82.138.237.198" dst_port="5555"/>
            <filter src_ip="37.110.224.168" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398976"/>
        <to usec="0" sec="1628398989"/>
    </anomaly>
    <anomaly type="suspicious" value="1.03719,1.30633,010,1 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="165.25.80.204" src_port="61953" dst_port="9450"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399512"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="139.68.42.94" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398973"/>
        <to usec="0" sec="1628398985"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,010,0 0 0 1 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="144.217.28.92" src_port="443"/>
            <filter dst_ip="144.217.28.92" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="162.158.102.129" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398940"/>
        <to usec="0" sec="1628398953"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87905,1.28972,010,1 1 1 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="205.78.168.222" src_port="49714" dst_port="22"/>
            <filter src_ip="159.65.42.5" src_port="61953" dst_port="1934"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399493"/>
    </anomaly>
    <anomaly type="suspicious" value="0.900552,1.29326,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="88.226.44.145" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1628399039"/>
        <to usec="0" sec="1628399042"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87905,1.28972,010,1 1 1 1 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="68.88.191.178" src_port="56738" dst_port="5226"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399448"/>
    </anomaly>
    <anomaly type="suspicious" value="0.87905,1.28972,010,1 1 1 1 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="125.140.116.251" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1628398808"/>
        <to usec="0" sec="1628399605"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="74.23.240.132"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399448"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="121.198.24.121"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398908"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,999,0 0 0 1 1 0 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="170.20.180.216" dst_ip="133.196.85.188" dst_port="9381"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398908"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,999,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter src_ip="103.89.236.128" dst_ip="203.109.249.236"/>
            <filter dst_ip="203.109.249.236"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398908"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,999,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.217.81.123" dst_ip="134.0.220.137" src_port="58840" dst_port="8801"/>
            <filter src_ip="163.217.81.123" dst_ip="134.0.220.137" src_port="58839" dst_port="8801"/>
            <filter src_ip="163.217.81.123" dst_ip="134.0.220.137" src_port="58838" dst_port="8801"/>
            <filter src_ip="163.217.81.123" dst_ip="134.0.220.137" src_port="53306" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398998"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="163.217.140.49" src_port="443"/>
        </slice>
        <from usec="0" sec="1628398801"/>
        <to usec="0" sec="1628399176"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,999,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="38.83.103.190" dst_port="8883"/>
            <filter dst_ip="38.83.103.190" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398801"/>
        <to usec="0" sec="1628398908"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,999,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.109.244.184" dst_ip="216.18.144.101" dst_port="53"/>
        </slice>
        <from usec="0" sec="1628398802"/>
        <to usec="0" sec="1628398838"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00943,1.29053,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398998"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00943,1.29053,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398998"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="66.169.14.131" src_port="443"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398927"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="178.191.99.37" src_port="61953" dst_port="9001"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398998"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="68.88.109.189" src_port="61953" dst_port="9019"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398998"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,020,0 0 0 1 1 0 0 0 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="3.32.184.148"/>
        </slice>
        <from usec="0" sec="1628398839"/>
        <to usec="0" sec="1628398946"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.217.182.184" dst_ip="52.244.127.56" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398887"/>
        <to usec="0" sec="1628398973"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="163.217.12.154" dst_ip="42.224.119.122" src_port="25"/>
            <filter src_ip="163.217.12.149" dst_ip="42.224.119.122" src_port="25"/>
            <filter src_ip="133.221.3.254" dst_ip="42.224.119.122" src_port="25"/>
            <filter src_ip="133.221.3.98" dst_ip="42.224.119.122" src_port="25"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399088"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="157.22.249.252" src_port="61953" dst_port="8856"/>
            <filter src_ip="122.95.85.175" src_port="54697" dst_port="23"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399178"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="202.244.220.103" dst_ip="15.218.23.129" dst_port="53"/>
            <filter src_ip="202.244.220.100" dst_ip="15.218.23.129" dst_port="53"/>
            <filter src_ip="202.244.220.84" dst_ip="15.218.23.129" dst_port="53"/>
        </slice>
        <from usec="0" sec="1628398801"/>
        <to usec="0" sec="1628399358"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="202.244.220.205" dst_ip="52.234.211.170" src_port="60880" dst_port="443"/>
            <filter src_ip="202.244.220.205" dst_ip="52.234.211.170" src_port="60656" dst_port="443"/>
            <filter src_ip="202.244.220.205" dst_ip="52.234.211.170" src_port="50815" dst_port="443"/>
            <filter src_ip="202.244.220.205" dst_ip="52.234.211.170" src_port="49187" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398801"/>
        <to usec="0" sec="1628399083"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter dst_ip="38.83.103.191" dst_port="8883"/>
        </slice>
        <from usec="0" sec="1628398801"/>
        <to usec="0" sec="1628399524"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="167.24.133.100"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399627"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,503,0 0 0 1 1 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="203.109.255.138" dst_ip="66.64.115.69" src_port="80"/>
        </slice>
        <from usec="0" sec="1628398805"/>
        <to usec="0" sec="1628399079"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="133.221.129.151" dst_ip="18.49.82.16" dst_port="443"/>
            <filter src_ip="133.221.129.75" dst_ip="18.49.82.16" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398806"/>
        <to usec="0" sec="1628399085"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="163.217.81.139" dst_ip="31.54.171.60" src_port="61732" dst_port="443"/>
            <filter src_ip="163.217.81.139" dst_ip="31.54.171.60" src_port="55400" dst_port="443"/>
            <filter src_ip="163.217.247.58" dst_ip="31.54.171.60" src_port="64668" dst_port="443"/>
            <filter src_ip="163.217.247.58" dst_ip="31.54.171.60" src_port="54304" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398813"/>
        <to usec="0" sec="1628399079"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="151.133.187.208" dst_ip="163.217.91.174" src_port="443"/>
        </slice>
        <from usec="0" sec="1628398836"/>
        <to usec="0" sec="1628399085"/>
    </anomaly>
    <anomaly type="suspicious" value="1.03719,1.30633,999,1 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="163.217.80.248" dst_port="443"/>
            <filter dst_ip="198.12.92.57" dst_port="443"/>
            <filter dst_ip="198.12.92.57" dst_port="8801"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399448"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,502,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="133.196.95.60" dst_ip="176.78.144.105" src_port="22" dst_port="64247"/>
            <filter src_ip="133.196.95.60" dst_ip="176.78.144.105" src_port="22" dst_port="60271"/>
            <filter src_ip="133.196.95.58" dst_ip="176.78.144.105" src_port="22" dst_port="63048"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399177"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="139.67.42.157" src_port="61953" dst_port="2103"/>
        </slice>
        <from usec="0" sec="1628398801"/>
        <to usec="0" sec="1628399178"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,999,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.102.145.57"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399624"/>
    </anomaly>
    <anomaly type="suspicious" value="1.23758,1.31359,504,0 0 0 0 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="162.232.36.111" src_port="443"/>
            <filter src_ip="18.98.124.129" dst_ip="163.217.82.220" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="163.217.123.91"/>
            <filter src_ip="104.94.225.62" src_port="5353"/>
        </slice>
        <from usec="0" sec="1628398803"/>
        <to usec="0" sec="1628399356"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,502,0 0 0 1 1 0 0 0 0 0 0 0,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="205.78.173.82" src_port="22"/>
            <filter dst_ip="205.78.173.82"/>
        </slice>
        <from usec="0" sec="1628398804"/>
        <to usec="0" sec="1628399358"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="20.130.82.255" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628399121"/>
        <to usec="0" sec="1628399258"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="163.217.83.224" dst_ip="47.26.252.27" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628399128"/>
        <to usec="0" sec="1628399289"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="202.102.148.25" dst_ip="45.206.8.163" src_port="143"/>
            <filter src_ip="202.102.144.118" dst_ip="45.206.8.163" src_port="143"/>
        </slice>
        <from usec="0" sec="1628399133"/>
        <to usec="0" sec="1628399358"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.109.255.132" src_port="443"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399448"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="92.147.133.33" src_port="24328" dst_port="50482"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399448"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,020,0 0 0 1 1 0 0 0 0 0 0 0,hostout">
        <slice>
            <filter src_ip="133.221.24.89" dst_ip="147.187.8.193"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399448"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,020,0 0 0 1 1 0 0 0 0 0 0 0,ttl_error">
        <slice>
            <filter src_ip="203.109.243.200" dst_ip="106.140.176.27"/>
            <filter src_ip="203.238.183.234" dst_ip="106.140.176.27"/>
            <filter src_ip="202.127.181.1" dst_ip="106.140.176.27"/>
            <filter src_ip="202.254.201.124" dst_ip="106.140.176.27"/>
            <filter src_ip="133.117.4.152" dst_ip="106.140.176.27"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399448"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="167.185.208.243" src_port="61953" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399446"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="143.58.181.194" src_port="61953" dst_port="8666"/>
        </slice>
        <from usec="0" sec="1628398802"/>
        <to usec="0" sec="1628399447"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,502,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="133.221.183.108" dst_ip="150.160.188.9" src_port="22"/>
            <filter src_ip="133.221.24.63" dst_ip="150.160.188.9" src_port="22"/>
        </slice>
        <from usec="0" sec="1628398866"/>
        <to usec="0" sec="1628399424"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="133.221.3.98" dst_ip="42.224.119.99" src_port="25"/>
            <filter src_ip="133.221.3.254" dst_ip="42.224.119.99" src_port="25"/>
            <filter src_ip="163.217.12.149" dst_ip="42.224.119.99" src_port="25"/>
        </slice>
        <from usec="0" sec="1628399100"/>
        <to usec="0" sec="1628399448"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="46.229.169.148" src_port="61953" dst_port="3002"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="163.217.133.140"/>
            <filter src_ip="163.217.179.233" dst_ip="18.98.45.253" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399627"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="52.246.225.8" dst_ip="163.217.233.6" src_port="443" dst_port="50709"/>
            <filter src_ip="52.246.225.8" dst_ip="163.217.245.76" src_port="443" dst_port="53426"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399534"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="193.125.50.232" dst_port="2222"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399533"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="163.217.230.90" dst_port="443"/>
            <filter dst_ip="23.234.247.14"/>
        </slice>
        <from usec="0" sec="1628398801"/>
        <to usec="0" sec="1628399628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="192.156.84.222" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398803"/>
        <to usec="0" sec="1628399538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="146.90.88.109" dst_port="1234"/>
            <filter src_ip="146.90.88.109" dst_port="2379"/>
            <filter src_ip="146.90.88.109" dst_port="5985"/>
        </slice>
        <from usec="0" sec="1628398803"/>
        <to usec="0" sec="1628399531"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,999,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter dst_ip="208.171.71.252" src_port="23395"/>
            <filter dst_ip="208.171.71.252" src_port="13912"/>
            <filter dst_ip="208.171.71.252" src_port="12609"/>
            <filter dst_ip="208.171.71.51" src_port="23395"/>
            <filter dst_ip="208.171.71.51" src_port="13912"/>
            <filter dst_ip="208.171.71.51" src_port="12609"/>
            <filter src_ip="131.110.121.10" dst_ip="208.171.71.252" dst_port="53"/>
            <filter src_ip="131.110.121.10" dst_ip="208.171.71.51" dst_port="53"/>
            <filter src_ip="131.110.121.10" src_port="23395" dst_port="53"/>
            <filter src_ip="131.110.121.10" src_port="13912" dst_port="53"/>
            <filter src_ip="131.110.121.10" src_port="12609" dst_port="53"/>
        </slice>
        <from usec="0" sec="1628398803"/>
        <to usec="0" sec="1628399537"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="71.199.117.253" src_port="50880" dst_port="50880"/>
        </slice>
        <from usec="0" sec="1628398806"/>
        <to usec="0" sec="1628399537"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,999,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.109.240.120" dst_port="25"/>
        </slice>
        <from usec="0" sec="1628398807"/>
        <to usec="0" sec="1628399535"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,999,0 0 0 1 1 0 0 0 0 0 0 0,ptpposcaUDP">
        <slice>
            <filter src_ip="163.217.100.237" dst_ip="144.203.15.8" src_port="53"/>
        </slice>
        <from usec="0" sec="1628398817"/>
        <to usec="0" sec="1628399538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="46.22.199.206" src_port="52869"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399535"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,503,0 0 0 1 1 0 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="203.109.245.175" dst_ip="107.169.223.126" src_port="80"/>
        </slice>
        <from usec="0" sec="1628398826"/>
        <to usec="0" sec="1628399528"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.217.63.21" dst_ip="141.157.249.170" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398826"/>
        <to usec="0" sec="1628399538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.204.215.116"/>
        </slice>
        <from usec="0" sec="1628398838"/>
        <to usec="0" sec="1628399505"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22202,1.3101,010,0 0 0 1 1 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="79.128.63.123" src_port="48980" dst_port="33891"/>
            <filter src_ip="79.128.63.123" src_port="48980" dst_port="33389"/>
            <filter src_ip="79.128.63.123" src_port="48980" dst_port="3388"/>
            <filter src_ip="79.128.63.123" src_port="48980" dst_port="3396"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="203.109.255.157" dst_ip="91.102.172.223" src_port="53935" dst_port="443"/>
            <filter src_ip="203.109.255.157" dst_ip="91.102.172.223" src_port="52282" dst_port="443"/>
            <filter src_ip="163.217.220.226" dst_ip="91.102.172.223" src_port="59306" dst_port="443"/>
            <filter src_ip="203.109.255.49" dst_ip="91.102.172.223" src_port="50936" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628399400"/>
        <to usec="0" sec="1628399455"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,999,0 0 0 1 1 0 0 0 0 0 0 0,ntscTCPTCPICrp">
        <slice>
            <filter dst_ip="167.24.133.50"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399628"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="133.221.129.194" dst_ip="216.108.28.103" dst_port="443"/>
            <filter src_ip="131.110.41.65" dst_ip="216.108.28.103" dst_port="443"/>
            <filter src_ip="133.221.129.52" dst_ip="216.108.28.103" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398861"/>
        <to usec="0" sec="1628399586"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,999,0 0 0 1 1 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="131.110.15.26" dst_ip="70.178.130.149" src_port="38602" dst_port="4815"/>
            <filter src_ip="131.110.15.26" dst_ip="70.178.130.149" src_port="53" dst_port="80"/>
            <filter src_ip="131.110.15.31" dst_ip="70.178.130.149" src_port="38602" dst_port="4815"/>
            <filter src_ip="131.110.15.31" dst_ip="70.178.130.149" src_port="53" dst_port="80"/>
        </slice>
        <from usec="0" sec="1628399562"/>
        <to usec="0" sec="1628399588"/>
    </anomaly>
    <anomaly type="suspicious" value="1.28354,1.28497,010,0 0 0 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="74.23.240.129"/>
            <filter src_ip="192.30.82.229" dst_port="3479"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,010,0 0 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="185.50.7.10" src_port="45893"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06528,1.26138,010,0 0 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="144.217.28.92" dst_ip="202.102.144.169"/>
            <filter src_ip="144.217.28.92" dst_port="443"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.169" dst_port="443"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.169" dst_port="80"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399448"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0831,1.26501,010,0 0 0 0 0 0 1 0 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="71.186.177.104" dst_ip="202.102.149.120" dst_port="443"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.149.120" dst_port="80"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20525,1.37188,011,0 0 0 1 0 0 0 1 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="203.109.255.44" dst_ip="91.23.225.196" dst_port="58604"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399448"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0831,1.26501,010,0 0 0 0 0 0 1 0 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter src_ip="71.186.177.104" dst_ip="202.102.149.134" dst_port="443"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.149.134" dst_port="80"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0831,1.26501,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.114" dst_port="80"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.144.114" dst_port="443"/>
            <filter src_ip="170.20.47.177" dst_ip="202.102.144.114" dst_port="9430"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0831,1.26501,010,0 0 0 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="71.186.177.104" dst_port="80"/>
            <filter dst_ip="202.102.149.220" dst_port="80"/>
            <filter src_ip="71.186.177.104" dst_ip="202.102.149.220" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0831,1.26501,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.109.244.190" dst_port="53"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0831,1.26501,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.109.255.54" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,004,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="202.102.149.161"/>
            <filter dst_ip="202.102.144.21"/>
            <filter dst_ip="202.102.145.181"/>
            <filter dst_port="445"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399535"/>
    </anomaly>
    <anomaly type="suspicious" value="1.38448,1.41357,504,0 0 0 1 1 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="20.197.161.242" dst_port="443"/>
            <filter dst_ip="202.254.251.137" dst_port="443"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0831,1.26501,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.102.149.44" dst_port="24073"/>
        </slice>
        <from usec="0" sec="1628399115"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20525,1.37188,020,0 0 0 1 0 0 0 1 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="133.221.18.177"/>
            <filter dst_ip="54.199.82.117"/>
            <filter dst_ip="44.61.62.104"/>
        </slice>
        <from usec="0" sec="1628398821"/>
        <to usec="0" sec="1628399517"/>
    </anomaly>
    <anomaly type="suspicious" value="1.38448,1.41357,010,0 0 0 1 1 0 1 0 0 0 0 0,sptpDoSSYN">
        <slice>
            <filter src_ip="42.43.237.124" dst_ip="133.196.93.250" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399411"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0831,1.26501,010,0 0 0 0 0 0 1 0 0 0 0 0,poscaSYN">
        <slice>
            <filter src_ip="147.187.8.193" dst_ip="203.109.242.7" src_port="32766"/>
        </slice>
        <from usec="0" sec="1628399115"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0831,1.26501,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="192.30.81.139" dst_port="3479"/>
        </slice>
        <from usec="0" sec="1628399250"/>
        <to usec="0" sec="1628399296"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,poscaSYN">
        <slice>
            <filter src_ip="191.140.190.145" dst_ip="163.217.58.184"/>
            <filter src_ip="161.246.69.170" dst_ip="163.217.58.184" src_port="58929"/>
        </slice>
        <from usec="0" sec="1628398827"/>
        <to usec="0" sec="1628399618"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0831,1.26501,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="114.144.194.103" src_port="59208" dst_port="2376"/>
        </slice>
        <from usec="0" sec="1628399250"/>
        <to usec="0" sec="1628399296"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0831,1.26501,502,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="172.17.0.6" dst_ip="74.29.13.193" dst_port="22"/>
            <filter src_ip="203.109.255.92" dst_ip="74.29.13.193" dst_port="22"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20525,1.37188,020,0 0 0 1 0 0 0 1 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="69.21.203.151"/>
        </slice>
        <from usec="0" sec="1628398817"/>
        <to usec="0" sec="1628399441"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0831,1.26501,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="3.215.207.211"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628398846"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0831,1.26501,011,0 0 0 0 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="203.109.255.44" dst_ip="91.23.225.196" dst_port="58604"/>
        </slice>
        <from usec="0" sec="1628399115"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0831,1.26501,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICecrqICecrqdurmterp">
        <slice>
            <filter dst_ip="203.109.241.54"/>
        </slice>
        <from usec="0" sec="1628399205"/>
        <to usec="0" sec="1628399251"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0831,1.26501,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="3.188.156.126"/>
        </slice>
        <from usec="0" sec="1628399115"/>
        <to usec="0" sec="1628399161"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,010,0 0 0 1 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="104.15.114.174" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,999,0 0 0 1 0 0 0 0 0 1 0 0,salphfl">
        <slice>
            <filter src_ip="133.221.25.61" dst_ip="220.98.103.141" src_port="23389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,999,0 0 0 1 0 0 0 0 0 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="133.196.95.77" dst_ip="199.12.193.236" src_port="1025"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="138.198.18.187"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22202,1.3101,504,0 0 0 1 1 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="174.102.37.132" dst_ip="163.217.231.93" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="143.234.4.60" src_port="61953" dst_port="7031"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="143.58.217.192"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,010,0 0 0 1 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="147.187.31.102" src_port="61953" dst_port="89"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,010,0 0 0 1 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="147.187.4.248" src_port="61953" dst_port="8844"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="159.65.145.177" src_port="61953" dst_port="9152"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,999,0 0 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="60.24.59.158" src_port="2853"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,504,0 0 0 1 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="163.217.8.161" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,020,0 0 0 1 1 0 0 0 0 0 0 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="69.27.136.65"/>
        </slice>
        <from usec="0" sec="1628398804"/>
        <to usec="0" sec="1628399626"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="165.253.125.38" src_port="61953" dst_port="9980"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990915,1.21681,010,1 1 0 0 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="187.225.246.1" dst_port="5555"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22202,1.3101,020,0 0 0 1 1 0 0 0 0 1 0 0,netout">
        <slice>
            <filter src_ip="202.127.181.1"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,504,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="202.127.181.44"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,502,0 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="202.254.234.132" dst_ip="82.151.8.182" src_port="22"/>
            <filter src_ip="202.254.234.132"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,999,0 0 0 1 1 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="47.236.182.105" src_port="23"/>
            <filter src_ip="202.102.144.12" dst_ip="139.255.206.202" src_port="23"/>
            <filter dst_ip="47.236.182.105"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399448"/>
    </anomaly>
    <anomaly type="suspicious" value="1.13374,1.31279,011,1 1 1 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="211.33.150.1" src_port="8291"/>
            <filter src_ip="202.102.145.122" dst_ip="170.20.47.177" src_port="7002"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.13308,1.26031,010,0 0 0 1 0 0 0 0 0 0 1 0,mptp">
        <slice>
            <filter dst_ip="89.0.61.105"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06528,1.26138,011,0 0 0 1 0 0 1 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="203.109.255.44" dst_ip="91.23.226.243"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399374"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="45.214.87.14"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="45.214.87.30" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYN">
        <slice>
            <filter src_ip="47.254.168.167"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="185.219.219.55" src_port="54658" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399538"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15049,1.31627,010,1 1 1 0 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="60.5.70.248" dst_port="5555"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22202,1.3101,010,0 0 0 1 1 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="45.100.13.109" dst_port="43538"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,504,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="13.30.21.19"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,010,0 0 0 1 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="162.138.146.213"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="193.5.13.60" dst_ip="163.217.82.182" src_port="8801" dst_port="60401"/>
            <filter src_ip="193.5.13.60" dst_ip="163.217.82.182" src_port="8801" dst_port="53327"/>
            <filter src_ip="193.5.13.60" dst_ip="163.217.82.182" src_port="8801" dst_port="53008"/>
            <filter src_ip="193.5.13.60" dst_ip="163.217.82.182" src_port="443" dst_port="65465"/>
            <filter src_ip="193.5.13.60" dst_ip="163.217.82.182" src_port="443" dst_port="65464"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,504,0 0 0 1 1 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.217.129.79" dst_ip="163.217.235.84" src_port="443"/>
            <filter src_ip="163.217.129.79" dst_ip="163.217.129.103" src_port="443"/>
        </slice>
        <from usec="0" sec="1628399026"/>
        <to usec="0" sec="1628399537"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="104.144.121.127" dst_ip="163.217.81.36" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.0831,1.26501,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="45.113.20.113" dst_port="81"/>
            <filter src_ip="45.113.20.113" dst_port="1080"/>
            <filter src_ip="45.113.20.113" dst_port="16789"/>
        </slice>
        <from usec="0" sec="1628399250"/>
        <to usec="0" sec="1628399296"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,504,0 0 0 1 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.217.132.181" src_port="443"/>
            <filter src_ip="54.65.63.198" dst_ip="163.217.132.181" src_port="3478"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,504,0 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="151.133.90.132" src_port="443"/>
            <filter src_ip="104.147.151.74" dst_ip="163.217.243.194" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.990298,1.28698,010,0 0 0 1 1 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="95.196.159.53" src_port="20484" dst_port="23"/>
        </slice>
        <from usec="0" sec="1628398800"/>
        <to usec="0" sec="1628399537"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,504,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="143.48.177.161" dst_ip="163.217.81.139" src_port="443"/>
            <filter src_ip="143.48.177.161" dst_ip="163.217.99.36" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,504,0 0 0 1 0 0 0 0 0 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="133.221.129.27" dst_ip="18.41.8.181" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.919082,1.16986,999,1 0 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="203.109.242.5" dst_ip="183.125.240.81" src_port="10001" dst_port="7777"/>
            <filter src_ip="203.109.242.5" dst_ip="183.125.240.79" src_port="10001" dst_port="7777"/>
            <filter src_ip="203.109.242.5" dst_ip="183.125.240.80" src_port="10001" dst_port="7777"/>
            <filter src_ip="203.109.242.5" dst_ip="36.212.21.116" src_port="10001" dst_port="7777"/>
            <filter src_ip="203.109.246.218" dst_ip="183.125.240.81" src_port="10001" dst_port="7777"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,999,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="203.109.240.5" dst_ip="198.212.136.220" src_port="53"/>
            <filter src_ip="202.254.229.158" dst_ip="198.212.136.220" src_port="53"/>
            <filter src_ip="202.244.220.84" dst_ip="198.212.136.220" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,004,0 0 0 1 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="202.102.149.51" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,503,0 0 0 1 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="75.189.205.13" dst_ip="203.109.252.191" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,999,0 0 0 0 0 0 0 0 0 1 0 0,salphfl">
        <slice>
            <filter src_ip="91.245.204.27" dst_ip="203.109.252.177"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,999,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="212.197.229.75"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,504,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="31.54.171.58"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,999,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="39.26.117.29"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,999,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="133.196.95.105" dst_ip="106.179.86.70"/>
            <filter src_ip="133.196.95.105" dst_ip="170.20.49.57" src_port="9635"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="13.30.21.19" dst_ip="163.217.36.0" src_port="443" dst_port="52592"/>
            <filter src_ip="13.30.21.19" dst_ip="163.217.36.0" src_port="443" dst_port="52591"/>
            <filter src_ip="13.30.21.19" dst_ip="163.217.36.0" src_port="443" dst_port="52590"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00943,1.29053,503,0 0 0 0 1 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.217.246.205"/>
        </slice>
        <from usec="0" sec="1628398802"/>
        <to usec="0" sec="1628399538"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,502,0 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="133.196.252.34" dst_ip="201.5.199.31" src_port="22"/>
            <filter dst_ip="45.104.247.197"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="34.39.153.59" dst_ip="163.217.179.250" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,504,0 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="163.217.129.22" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,504,0 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="54.82.75.15" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,020,0 0 0 0 0 0 0 0 0 1 0 0,ntscICec">
        <slice>
            <filter src_ip="14.201.52.202"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="45.8.163.195" dst_ip="163.217.195.8" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,011,0 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="162.234.15.212" src_port="13053"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,010,0 0 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="202.102.149.96"/>
            <filter src_ip="202.102.144.48"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.843429,1.14423,503,0 0 0 1 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="203.109.252.191" dst_ip="75.189.205.13" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,504,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.217.81.123" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,504,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="31.54.171.58" dst_ip="163.217.83.187" src_port="443"/>
            <filter src_ip="31.54.171.58" dst_ip="163.217.92.211" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,504,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="163.217.82.173" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,504,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="163.217.226.215" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.14984,1.26393,503,0 0 0 0 0 0 0 0 0 0 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.109.226.99"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="202.244.220.245" dst_ip="60.153.186.20" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865817,1.14822,010,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="89.0.61.105"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
