<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="anomalous" value="2.2743,2.16987,999,1 1 0 1 1 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter src_ip="203.216.119.104" dst_ip="206.28.24.241"/>
            <filter src_ip="203.216.119.104" dst_ip="204.194.1.222"/>
            <filter src_ip="203.216.119.104" dst_ip="50.7.68.30"/>
            <filter src_ip="203.216.119.104" dst_ip="128.181.126.113"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.69226,2.59715,999,1 1 1 1 1 1 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="157.88.16.135" dst_ip="82.12.17.179" src_port="993"/>
            <filter src_ip="157.88.16.135" dst_ip="163.226.182.233" src_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.32889,2.29625,010,1 1 1 0 0 0 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="218.157.207.157" src_port="9090" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.56102,2.41251,010,1 1 1 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="39.183.201.207" dst_port="6379"/>
            <filter src_ip="20.78.223.81" dst_port="6379"/>
            <filter src_ip="101.5.153.102" dst_port="6379"/>
            <filter src_ip="103.226.150.170" src_port="5086" dst_port="29565"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="8.22834,6.5629,010,1 1 1 1 1 0 1 1 1 1 0 0,ntscSYN">
        <slice>
            <filter src_ip="221.188.123.46" dst_port="6379"/>
            <filter src_ip="156.191.30.93" dst_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.32889,2.29625,012,1 1 1 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="39.180.224.176" dst_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.91429,2.39376,901,1 1 1 1 1 0 1 0 0 1 1 0,empty">
        <slice/>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.61184,2.99435,999,1 0 0 1 1 1 1 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="133.11.180.130" dst_ip="95.149.3.172" src_port="1194"/>
            <filter src_ip="157.88.218.94" dst_ip="95.149.3.172" src_port="1194"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.91984,2.74735,010,0 0 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="167.145.158.253"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.91984,2.74735,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.226.64.27" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.91984,2.74735,010,0 0 0 1 1 1 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="133.4.190.158" dst_ip="107.161.232.38" src_port="80"/>
            <filter src_ip="202.26.195.80" dst_ip="107.161.232.38" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.05472,2.03717,999,1 1 1 1 1 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="79.34.78.166" src_port="5900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="8.28678,6.56351,010,1 1 1 1 1 0 1 1 1 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="94.166.73.108" src_port="45770" dst_port="7443"/>
            <filter src_ip="94.166.73.108" src_port="45770" dst_port="10443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.96213,2.71774,504,1 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.226.183.235" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.2743,2.16987,504,1 1 0 1 1 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="202.172.32.253" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.2743,2.16987,999,1 1 0 1 1 0 0 0 0 1 1 1,ipv4gretun">
        <slice>
            <filter dst_ip="203.216.119.104"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.48199,2.35596,020,1 0 0 1 1 0 1 0 0 1 0 0,icmp_error">
        <slice>
            <filter src_ip="139.219.214.223" src_port="44719" dst_port="2376"/>
            <filter dst_ip="203.216.112.138"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.91984,2.74735,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.226.65.221" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.96213,2.71774,504,1 0 0 1 1 1 0 0 0 1 1 1,mptpla">
        <slice>
            <filter src_ip="13.103.41.183" dst_ip="203.216.123.35" src_port="443"/>
            <filter src_ip="52.124.46.137" dst_ip="203.216.123.35" src_port="443"/>
            <filter src_ip="52.130.66.83" dst_ip="203.216.123.35" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.91984,2.74735,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="104.84.246.227"/>
            <filter src_ip="157.88.97.161" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.96213,2.71774,504,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="157.88.61.114" dst_port="443"/>
            <filter src_ip="157.88.14.231" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.47999,2.22584,504,1 1 1 1 1 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="157.88.61.117" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.07304,2.50766,010,1 1 0 1 1 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="92.179.140.22" src_port="45646" dst_port="2375"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.0272,2.70399,503,1 1 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.216.119.175" src_port="80"/>
            <filter src_ip="203.216.120.222" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.74138,2.34181,901,1 1 0 1 1 0 1 0 0 1 1 0,empty">
        <slice/>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.57724,3.02125,010,0 0 0 1 1 1 1 0 0 1 1 1,dntscSYN">
        <slice>
            <filter src_ip="192.150.7.114" dst_port="8022"/>
            <filter dst_ip="163.226.121.39" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.96213,2.71774,504,1 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.216.116.226" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.07304,2.50766,503,1 1 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="80"/>
            <filter dst_ip="162.130.220.122" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.47999,2.22584,503,1 1 1 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.216.120.222" dst_port="80"/>
            <filter dst_ip="203.216.119.175" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.86956,2.11387,999,1 1 1 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="71.6.216.232" dst_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.58661,2.05486,011,1 1 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="39.183.201.207" src_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.373,2.01911,504,1 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="133.11.234.210" dst_port="443"/>
            <filter dst_ip="3.180.225.10" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.638,2.09232,010,1 1 1 1 1 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="116.154.60.171"/>
        </slice>
        <from usec="0" sec="1639285200"/>
        <to usec="0" sec="1639286099"/>
    </anomaly>
    <anomaly type="suspicious" value="1.88808,2.24565,504,0 0 0 1 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="209.250.227.7" dst_ip="203.216.114.165" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.51249,2.05917,010,1 1 1 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="167.145.138.211"/>
            <filter src_ip="160.171.150.234" dst_port="5632"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.50826,2.00056,010,1 1 0 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="203.216.115.164"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.05019,2.19238,010,1 1 0 1 0 0 0 0 0 1 1 1,sntscSYN">
        <slice>
            <filter src_ip="165.99.16.200" src_port="32767" dst_port="28081"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.08123,2.69995,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1639285200"/>
        <to usec="0" sec="1639285668"/>
    </anomaly>
    <anomaly type="suspicious" value="2.08123,2.69995,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1639285200"/>
        <to usec="0" sec="1639285668"/>
    </anomaly>
    <anomaly type="suspicious" value="2.09015,2.45894,010,0 0 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="167.145.138.195"/>
            <filter src_ip="192.150.3.177" dst_port="7443"/>
            <filter src_ip="192.150.0.141" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1639285200"/>
        <to usec="0" sec="1639285938"/>
    </anomaly>
    <anomaly type="suspicious" value="2.14737,2.50332,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="192.150.3.149" dst_port="631"/>
        </slice>
        <from usec="0" sec="1639285830"/>
        <to usec="0" sec="1639285876"/>
    </anomaly>
    <anomaly type="suspicious" value="2.14737,2.50332,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="167.163.232.15" src_port="45960" dst_port="6818"/>
        </slice>
        <from usec="0" sec="1639285965"/>
        <to usec="0" sec="1639286011"/>
    </anomaly>
    <anomaly type="suspicious" value="2.14737,2.50332,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="157.197.245.44"/>
        </slice>
        <from usec="0" sec="1639285965"/>
        <to usec="0" sec="1639286011"/>
    </anomaly>
    <anomaly type="suspicious" value="1.51249,2.05917,010,1 1 1 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="185.85.30.52" dst_port="5351"/>
            <filter src_ip="147.206.76.212" src_port="80" dst_port="27017"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.01397,2.2586,503,1 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="163.181.4.24" dst_ip="163.226.133.54" src_port="80" dst_port="57574"/>
            <filter src_ip="163.181.4.24" dst_ip="163.226.133.54" src_port="80" dst_port="57567"/>
            <filter src_ip="163.181.4.24" dst_ip="163.226.133.54"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.05019,2.19238,503,1 1 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="157.88.159.1" src_port="53"/>
            <filter src_ip="47.149.70.131" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.88808,2.24565,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.216.127.147" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.50958,1.97382,504,1 1 0 1 1 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="192.41.211.103" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.88808,2.24565,504,0 0 0 1 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="203.216.126.20" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.95124,2.29415,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="104.235.248.13" dst_ip="163.226.96.203" src_port="443" dst_port="53921"/>
            <filter src_ip="104.235.248.13" dst_ip="163.226.96.203" src_port="443" dst_port="53916"/>
            <filter src_ip="104.235.248.13" dst_ip="163.226.96.203" src_port="443" dst_port="53741"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.50826,2.00056,999,1 1 0 1 0 0 0 0 0 1 1 0,ptpposcaUDP">
        <slice>
            <filter src_ip="133.11.237.60" dst_ip="117.234.44.205" src_port="1900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.68945,1.99464,504,1 0 0 1 1 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="157.88.145.32" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.50826,2.00056,504,1 1 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="40.141.221.5" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.12931,2.22368,999,0 0 0 1 1 0 0 0 0 1 1 1,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.216.114.128" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.12931,2.22368,504,0 0 0 1 1 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.226.68.215" src_port="443"/>
            <filter dst_ip="163.226.68.79" src_port="443"/>
            <filter dst_ip="163.226.213.165" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="2.12931,2.22368,504,0 0 0 1 1 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.226.105.248" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.50826,2.00056,020,1 1 0 1 0 0 0 0 0 1 1 0,ntscICec">
        <slice>
            <filter src_ip="151.119.163.30"/>
            <filter src_ip="18.161.116.2"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
