我必须对大型数据库(Snort 警报)进行查询以查找重复条目。但是,我想出了下面的查询,但是执行起来需要很多时间!
SELECT sid, cid, timestamp, sig_name, inet_ntoa(ip_src), layer4_sport,
inet_ntoa(ip_dst), layer4_dport
FROM DB
WHERE (ip_dst IN
(SELECT ip_dst FROM DB GROUP BY ip_dst HAVING count(*) > 1)
AND timestamp IN
(SELECT timestamp FROM DB GROUP BY timestamp HAVING count(*) > 1)
AND layer4_dport IN
(SELECT layer4_dport FROM DB GROUP BY layer4_dport HAVING count(*)>1 ))
上面的查询试图查找具有相同的警报 ip_dst timestamp
以及layer4_dport
它们是否出现了不止一次。我希望它清楚!
有什么提示或技巧可以提高效率吗?