mysql - 捕捉马甲木偶

Question

我有一个日志表，其中包含用户 ID、IP 地址和登录日期时间。我需要找出通过设置多个帐户冒充其他用户的用户。

这是我的示例日志表:

+---------+-------------+---------------------+
| user id | ip address  | log in datetime     |
+---------+-------------+---------------------+
| 17      | 192.168.1.4 | 2012-04-01 00:01:00 |
+---------+-------------+---------------------+
| 21      | 192.168.1.2 | 2012-04-01 00:02:00 |
+---------+-------------+---------------------+
| 11      | 192.168.1.5 | 2012-04-01 00:06:00 |
+---------+-------------+---------------------+
| 1       | 192.168.1.3 | 2012-04-01 00:09:00 |
+---------+-------------+---------------------+
| 3       | 192.168.1.3 | 2012-04-01 00:15:00 |
+---------+-------------+---------------------+
| 8       | 192.168.1.5 | 2012-04-01 00:22:00 |
+---------+-------------+---------------------+
| 9       | 192.168.1.1 | 2012-04-01 00:26:00 |
+---------+-------------+---------------------+
| 13      | 192.168.2.1 | 2012-04-01 00:27:00 |
+---------+-------------+---------------------+
| 2       | 192.168.1.1 | 2012-04-01 00:28:00 |
+---------+-------------+---------------------+
| 33      | 192.168.1.7 | 2012-04-01 00:30:00 |
+---------+-------------+---------------------+
| 27      | 192.168.1.1 | 2012-04-01 00:31:00 |
+---------+-------------+---------------------+
| 22      | 192.168.1.7 | 2012-04-01 00:45:00 |
+---------+-------------+---------------------+

所以，我的问题是:如何选择具有相同 IP 地址且登录时间差小于 5 分钟的用户 ID 列表？

Answer 1

像这样怎么样 -

SELECT *
FROM log l1
INNER JOIN log l2
    ON l1.ip_address = l2.ip_address
    AND l1.user_id < l2.user_id
    AND l1.login _time BETWEEN (l2.login_time - INTERVAL 5 MINUTE) AND (l2.login_time + INTERVAL 5 MINUTE)