Data Science, Artificial Intelligence, Open Data, Open Source, Botnet.
self-join of the IP data, to find pairs of ips and filter them. The filter is done by the number of incidents both pair IPs are in, and the number of sites the pair has attacked: SELECT l.ip AS ip_1, r.ip AS ip_2, COUNT() AS incidents, COUNT(DISTINCT site_id) AS sites FROM ips AS l INNER JOIN ips r