Data storage for Intrusion Detection System

I write an IDS(in C) for a KNX network for my thesis.

For this, I just store all the telegrams within an SQLite database.
But I’m not sure if a SQL database is the best here.

I want to "ask questions to the data" like:

• is the source/destination address known
• Is the value within the known value range? (e.g temperature sensor sends always values between 18 and 25°C)

those questions may be answerable with an SQL statement
But a question like this would be way harder to answer with plain SQL

• What is the probability of one telegram following another? (not just the direct ancestor, but e.g the 5 ancestors)