Human:
Date first seen,Duration,Proto,Src IP Addr,Src Pt,Dst IP Addr,Dst Pt,Packets,Bytes,Flows,Flags,NAME_1,class,attackType,attackID,attackDescription  
2017-03-14 17:43:57.172,81412.697,TCP  ,EXT_SERVER,8082,OPENSTACK_NET,56978,    3057,   2.1 M,    1,.AP...,  0,normal,---,---,---  
2017-03-14 17:43:57.172,81412.697,TCP  ,OPENSTACK_NET,56978,EXT_SERVER,8082,    4748,   2.5 M,    1,.AP...,  0,normal,---,---,---  
2017-03-14 17:43:26.135,81504.787,TCP  ,EXT_SERVER,8082,OPENSTACK_NET,56979,    8639,   9.1 M,    1,.AP...,  0,normal,---,---,---  
2017-03-14 17:43:26.135,81504.787,TCP  ,OPENSTACK_NET,56979,EXT_SERVER,8082,   12024,  10.3 M,    1,.AP...,  0,normal,---,---,---  
2017-03-14 18:17:09.005,82100.692,TCP  ,EXT_SERVER,8082,OPENSTACK_NET,51649,   11012,  27.2 M,    1,.AP.S.,  0,normal,---,---,---  
2017-03-14 18:17:09.005,82100.692,TCP  ,OPENSTACK_NET,51649,EXT_SERVER,8082,   14186,   1.2 M,    1,.AP.S.,  0,normal,---,---,---  
2017-03-14 19:46:37.327,83640.139,TCP  ,EXT_SERVER,8082,OPENSTACK_NET,37039,    9974,  31.9 M,    1,.AP.S.,  0,normal,---,---,---  
2017-03-15 00:00:27.659,   14.644,TCP  ,10001_123,3477,EXT_SERVER,22,      13,    2843,    1,.APRS.,  0,suspicious,---,---,---  
2017-03-15 00:00:56.784,    0.000,TCP  ,EXT_SERVER,23,10003_214,42182,       1,      40,    1,.A.R..,  0,suspicious,---,---,---  
2017-03-15 00:00:56.784,    0.000,TCP  ,10003_214,42182,EXT_SERVER,23,       1,      46,    1,....S.,  0,suspicious,---,---,---  
2017-03-15 00:00:02.296,   62.046,TCP  ,10004_35,57382,EXT_SERVER,22,       7,     420,    1,.APRSF,  0,suspicious,---,---,---  
2017-03-15 00:00:02.296,   62.046,TCP  ,EXT_SERVER,22,10004_35,57382,      12,    4773,    1,.AP.SF,  0,suspicious,---,---,---  
2017-03-15 00:00:55.806,   14.313,TCP  ,EXT_SERVER,22,10001_123,3398,      20,    3065,    1,.AP.S.,  0,suspicious,---,---,---  
2017-03-15 00:00:55.806,   14.313,TCP  ,10001_123,3398,EXT_SERVER,22,      15,    2871,    1,.APRS.,  0,suspicious,---,---,---  
2017-03-15 00:01:28.437,    0.001,TCP  ,10005_82,24989,EXT_SERVER,7547,       1,      46,    1,....S.,  0,suspicious,---,---,---  
2017-03-15 00:01:28.437,    0.001,TCP  ,EXT_SERVER,7547,10005_82,24989,       1,      40,    1,.A.R..,  0,suspicious,---,---,---  
&nbsp;
above mentioned  is a csv file from network firewall, the column 'class' represent whether the log is normal or suspicious, please highlight the top three patterns for suspicious log

Assistant:   In your response, use words with all capital letters at least 12 times.
user