<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="suspicious" value="0.966576,1.33641,010,1 1 0 0 0 0 0 0 0 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="99.235.32.1" dst_port="5555"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.47287,1.4805,999,1 1 1 0 0 0 0 0 0 1 1 0,ntscUDPOther">
        <slice>
            <filter src_ip="95.147.158.21" src_port="39964" dst_port="389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="159.203.111.34" src_port="5074" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1633842726"/>
        <to usec="0" sec="1633842728"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="162.170.166.96" src_port="5966" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1633842457"/>
        <to usec="0" sec="1633842459"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="84.53.155.250" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1633842787"/>
        <to usec="0" sec="1633842792"/>
    </anomaly>
    <anomaly type="suspicious" value="1.31098,1.52157,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="160.116.8.45" dst_port="4430"/>
        </slice>
        <from usec="0" sec="1633842582"/>
        <to usec="0" sec="1633842631"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="144.161.4.58" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1633842347"/>
        <to usec="0" sec="1633842352"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.102.3.217" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1633842005"/>
        <to usec="0" sec="1633842819"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="146.247.101.35" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1633842078"/>
        <to usec="0" sec="1633842083"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.121.111.222" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1633842371"/>
        <to usec="0" sec="1633842375"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="95.57.144.23" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1633842053"/>
        <to usec="0" sec="1633842055"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="23.243.156.109" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1633842700"/>
        <to usec="0" sec="1633842701"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="77.146.122.51" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1633842185"/>
        <to usec="0" sec="1633842187"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="47.240.56.84" dst_port="22"/>
        </slice>
        <from usec="0" sec="1633842008"/>
        <to usec="0" sec="1633842009"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="122.2.191.175" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1633842151"/>
        <to usec="0" sec="1633842152"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="91.244.68.91" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1633842402"/>
        <to usec="0" sec="1633842868"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.190.17.111" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1633842509"/>
        <to usec="0" sec="1633842511"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="185.52.219.69" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1633842342"/>
        <to usec="0" sec="1633842343"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="115.27.212.249" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1633842002"/>
        <to usec="0" sec="1633842003"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="119.2.124.218" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1633842086"/>
        <to usec="0" sec="1633842088"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.6.4.137" dst_port="445"/>
        </slice>
        <from usec="0" sec="1633842596"/>
        <to usec="0" sec="1633842598"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="202.182.23.249" dst_port="1433"/>
            <filter src_ip="202.182.23.249" dst_port="445"/>
        </slice>
        <from usec="0" sec="1633842697"/>
        <to usec="0" sec="1633842711"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="117.162.90.153" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1633842203"/>
        <to usec="0" sec="1633842205"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="192.94.1.219" dst_port="1433"/>
            <filter src_ip="192.94.1.219" dst_port="445"/>
        </slice>
        <from usec="0" sec="1633842869"/>
        <to usec="0" sec="1633842876"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="117.34.168.219" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1633842148"/>
        <to usec="0" sec="1633842150"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="109.141.156.139" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1633842323"/>
        <to usec="0" sec="1633842324"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.89.1.114" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1633842073"/>
        <to usec="0" sec="1633842729"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.89.1.115" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1633842133"/>
        <to usec="0" sec="1633842727"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.89.1.116" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1633842085"/>
        <to usec="0" sec="1633842641"/>
    </anomaly>
    <anomaly type="suspicious" value="1.18849,1.49495,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="17.121.118.189" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1633842094"/>
        <to usec="0" sec="1633842898"/>
    </anomaly>
    <anomaly type="suspicious" value="1.2844,1.45822,010,1 1 1 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="144.161.4.58" src_port="1433"/>
            <filter dst_ip="144.161.4.58" src_port="65529"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966576,1.33641,999,1 1 0 0 0 0 0 0 0 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="133.250.190.59" dst_ip="87.19.99.102"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.1093,1.4965,010,0 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="171.14.73.41" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1633842471"/>
        <to usec="0" sec="1633842474"/>
    </anomaly>
    <anomaly type="suspicious" value="1.52515,1.56151,020,1 1 0 1 1 0 0 0 0 1 0 0,ttl_error">
        <slice>
            <filter src_ip="133.235.248.132"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.34419,1.52792,999,0 0 0 1 1 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="38.93.31.237" src_port="53"/>
            <filter dst_ip="163.44.223.76" src_port="53"/>
            <filter dst_ip="163.44.223.92" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25287,1.56301,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.235.123.207" dst_ip="107.38.150.143" dst_port="443"/>
        </slice>
        <from usec="0" sec="1633842001"/>
        <to usec="0" sec="1633842288"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25287,1.56301,504,0 0 0 1 1 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="203.50.25.240" dst_ip="52.81.234.214" dst_port="443"/>
        </slice>
        <from usec="0" sec="1633842001"/>
        <to usec="0" sec="1633842647"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25287,1.56301,504,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="202.235.35.195" dst_ip="52.196.148.12" dst_port="443"/>
            <filter src_ip="202.235.37.155" dst_ip="52.196.148.12" dst_port="443"/>
        </slice>
        <from usec="0" sec="1633842002"/>
        <to usec="0" sec="1633842826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25287,1.56301,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="202.235.33.64" dst_ip="87.26.231.19" src_port="25"/>
            <filter src_ip="202.235.39.135" dst_ip="87.26.231.19" src_port="25"/>
            <filter src_ip="202.235.35.168" dst_ip="87.26.231.19" src_port="25"/>
            <filter src_ip="133.235.177.1" dst_ip="87.26.231.19" src_port="25"/>
        </slice>
        <from usec="0" sec="1633842011"/>
        <to usec="0" sec="1633842262"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25287,1.56301,999,0 0 0 1 1 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="44.116.243.250" dst_port="53"/>
        </slice>
        <from usec="0" sec="1633842000"/>
        <to usec="0" sec="1633842377"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25287,1.56301,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.44.50.148" dst_ip="31.247.126.8" dst_port="443"/>
        </slice>
        <from usec="0" sec="1633842007"/>
        <to usec="0" sec="1633842376"/>
    </anomaly>
    <anomaly type="suspicious" value="1.25287,1.56301,504,0 0 0 1 1 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="52.112.236.18" dst_port="443"/>
        </slice>
        <from usec="0" sec="1633842051"/>
        <to usec="0" sec="1633842378"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06401,1.30994,504,1 0 0 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="163.44.125.202" src_port="42576"/>
            <filter src_ip="163.44.125.202" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.21219,1.35069,504,1 1 0 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.235.35.17" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.34419,1.52792,011,0 0 0 1 1 0 0 0 0 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="203.50.25.171" dst_ip="217.12.213.195" dst_port="42363"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.3295,1.39702,504,0 0 0 1 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="23.40.228.9" dst_ip="163.44.181.2" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.3295,1.39702,020,0 0 0 1 0 0 0 0 0 1 1 1,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="54.175.1.138"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966787,1.322,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.44.182.102" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966787,1.322,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="193.44.234.224" dst_ip="203.50.27.165" dst_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.958448,1.31558,503,1 0 0 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="203.50.19.254" dst_port="123"/>
            <filter dst_ip="203.50.18.176" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966787,1.322,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="126.80.11.164" dst_ip="163.44.221.132" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.3295,1.39702,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="17.121.118.189" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966787,1.322,010,0 0 0 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="139.1.169.216" dst_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.19928,1.34024,504,1 0 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_port="443"/>
            <filter dst_ip="41.1.53.134"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.3295,1.39702,999,0 0 0 1 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="163.44.64.218" dst_ip="54.162.33.209"/>
            <filter src_ip="163.44.64.218" dst_port="5802"/>
            <filter dst_ip="54.162.33.209" dst_port="5802"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.32366,1.40669,010,0 0 0 0 0 0 0 0 0 1 1 1,sntscSYN">
        <slice>
            <filter src_ip="165.21.181.211" src_port="61953" dst_port="2080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.32366,1.40669,010,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="167.129.5.35"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966787,1.322,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="167.90.106.17"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.3295,1.39702,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.44.15.6" src_port="443"/>
            <filter dst_ip="163.44.15.6"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966787,1.322,010,0 0 0 0 0 0 0 0 0 1 1 0,sptpDoSSYN">
        <slice>
            <filter src_ip="198.228.40.47" dst_ip="203.50.21.246" dst_port="23"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.974757,1.31171,504,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="202.235.35.54" dst_ip="121.207.110.66"/>
            <filter src_ip="202.235.35.54" src_port="22"/>
            <filter src_ip="202.235.35.54" src_port="443"/>
            <filter dst_ip="121.207.110.66" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966787,1.322,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.235.39.153" dst_ip="93.106.81.191" src_port="443"/>
            <filter src_ip="202.235.39.153" dst_ip="18.29.246.7" src_port="443"/>
            <filter src_ip="202.235.39.153"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.12085,1.34197,999,0 0 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="0.0.0.0" dst_ip="184.136.118.218"/>
            <filter src_ip="0.0.0.0" src_port="53"/>
            <filter dst_ip="184.136.118.218" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966787,1.322,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="209.202.196.22" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.3295,1.39702,999,0 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.44.124.119"/>
            <filter dst_ip="203.50.25.255" src_port="443"/>
            <filter dst_ip="163.44.124.239" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.3295,1.39702,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.44.27.79" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966787,1.322,010,0 0 0 0 0 0 0 0 0 1 1 0,sntscSYN">
        <slice>
            <filter src_ip="52.180.207.130" src_port="44249" dst_port="9833"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.32366,1.40669,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.44.124.28" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966787,1.322,020,0 0 0 0 0 0 0 0 0 1 1 0,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="103.114.188.191"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.3295,1.39702,020,0 0 0 1 0 0 0 0 0 1 1 1,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="124.6.129.178"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966787,1.322,504,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter src_ip="17.121.118.189" dst_ip="13.195.63.88" src_port="58130" dst_port="443"/>
            <filter src_ip="17.121.118.189" dst_ip="13.195.63.88" src_port="57732" dst_port="443"/>
            <filter src_ip="17.121.118.189" dst_ip="13.195.63.88" src_port="57602" dst_port="443"/>
            <filter src_ip="163.44.216.239" dst_ip="13.195.63.88" src_port="62488" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.32366,1.40669,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.44.125.64" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.3295,1.39702,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.44.55.181" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966787,1.322,999,0 0 0 0 0 0 0 0 0 1 1 0,mptpla">
        <slice>
            <filter dst_ip="202.16.157.13" dst_port="384"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.966787,1.322,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="203.50.18.16" dst_ip="40.108.52.70" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.73247,2.33115,999,1 1 1 1 1 1 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="203.50.18.199" dst_ip="206.83.219.30"/>
            <filter src_ip="203.50.18.199" dst_ip="204.219.157.2"/>
            <filter src_ip="203.50.18.199" dst_ip="13.124.200.23"/>
            <filter src_ip="203.50.18.199" dst_ip="128.126.253.49"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.72822,1.55659,999,1 1 1 0 0 0 0 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="176.114.174.249" src_port="42144" dst_port="5093"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.0925,1.75365,999,1 1 1 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="125.191.135.69" dst_port="9600"/>
            <filter src_ip="54.58.28.234" src_port="7593"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.60545,1.47066,010,1 1 0 0 0 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="80.93.146.241" src_port="64344" dst_port="2096"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.51222,1.43368,020,1 1 0 1 0 0 0 0 0 1 1 1,hostout">
        <slice>
            <filter src_ip="203.50.29.10"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.93086,2.39701,504,1 1 1 1 1 1 1 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="185.71.80.60" dst_ip="163.44.84.78" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.8189,1.57358,999,1 1 1 1 0 0 1 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="62.162.10.19" src_port="9999" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.88748,4.14365,011,0 0 0 0 0 0 1 1 1 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="217.12.213.195" dst_ip="203.50.25.171" src_port="42363"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.86315,4.15671,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICecrqICecrqdurmterp">
        <slice>
            <filter dst_ip="203.50.23.145"/>
        </slice>
        <from usec="0" sec="1633842000"/>
        <to usec="0" sec="1633842901"/>
    </anomaly>
    <anomaly type="anomalous" value="2.68907,2.28397,504,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="133.13.206.181"/>
            <filter src_ip="45.176.17.202" dst_ip="202.16.155.203" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.8189,1.57358,504,1 1 1 1 0 0 1 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="163.44.84.78" dst_ip="52.193.180.90" dst_port="443"/>
            <filter src_ip="163.44.84.78" dst_ip="52.70.58.12" dst_port="443"/>
            <filter src_ip="163.44.84.78" dst_ip="13.146.208.16" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.68907,2.28397,504,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="163.44.155.233" dst_port="443"/>
            <filter dst_ip="50.185.83.246" dst_port="8801"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.68907,2.28397,504,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
            <filter src_ip="172.94.207.216" dst_ip="202.225.37.137" dst_port="5900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.81464,1.58217,010,1 1 1 0 0 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="61.200.46.10" dst_port="6379"/>
            <filter src_ip="27.113.121.96" dst_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.50189,1.42384,503,1 0 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.50.19.199" dst_port="53"/>
            <filter dst_ip="203.50.18.16" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.8189,1.57358,010,1 1 1 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="192.241.175.156" dst_port="443"/>
            <filter src_ip="47.97.42.80" dst_port="6379"/>
            <filter src_ip="120.73.24.228" dst_port="6379"/>
            <filter src_ip="103.30.237.102" src_port="5081" dst_port="5094"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.57828,1.49836,502,1 1 1 1 0 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="31.33.70.71" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="4.88906,4.14038,010,0 0 0 1 0 0 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="89.238.37.248" dst_port="42231"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.65502,2.28499,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="133.13.37.6" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.87816,2.3802,504,1 1 1 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.44.180.102" src_port="443"/>
            <filter dst_ip="163.44.97.38" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.61027,1.46142,011,1 1 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="45.183.25.36" src_port="15311"/>
            <filter dst_ip="107.147.4.254" src_port="22" dst_port="57879"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.61027,1.46142,010,1 1 0 1 0 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="39.105.251.106" src_port="42001" dst_port="2375"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.93086,2.39701,010,1 1 1 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="5060"/>
            <filter src_ip="207.226.201.235" src_port="58660"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.93086,2.39701,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="192.241.166.82" dst_port="443"/>
            <filter src_ip="107.147.4.254" src_port="57879" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.72822,1.55659,504,1 1 1 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.50.1.129"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.16442,1.77639,901,1 1 1 1 1 0 1 0 0 1 1 1,empty">
        <slice/>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.90579,1.64521,010,1 0 0 1 1 0 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="193.44.232.163" src_port="41663"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.44004,1.42547,020,0 0 0 1 0 0 1 0 0 1 1 1,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="13.216.73.39"/>
            <filter dst_ip="34.44.232.197"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.77311,1.62206,504,0 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.44.124.50" src_port="443"/>
            <filter dst_ip="163.44.56.182" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.72822,1.55659,010,1 1 1 0 0 0 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="41.1.58.118" src_port="37918" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.77311,1.62206,504,0 0 0 1 1 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.44.125.202" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.8237,1.62063,010,1 0 0 1 1 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="167.90.106.87"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.50189,1.42384,504,1 0 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.44004,1.42547,504,0 0 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.44.182.54" src_port="443"/>
            <filter dst_ip="163.44.40.69" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
