I write an IDS(in C) for a KNX network for my thesis.
For this, I just store all the telegrams within an SQLite database. But I'm not sure if a SQL database is the best here.
I want to "ask questions to the data" like:
- is the source/destination address known
- Is the value within the known value range? (e.g temperature sensor sends always values between 18 and 25°C)
those questions may be answerable with an SQL statement But a question like this would be way harder to answer with plain SQL
- What is the probability of one telegram following another? (not just the direct ancestor, but e.g the 5 ancestors)