Fuzzing DBMS via NNLM

Yabin Li, Yuanping Nie, Xiaohui Kuang. 2022. International Conference on Data Science in Cyberspace.

Read the paper · doi:10.1109/dsc55868.2022.00057

What this paper does with SQLancer

Three citations describing SQLancer's oracles -- PQS, NoREC and query partitioning -- as the established ways of detecting correctness errors that do not crash the system. NNFuzz applies a neural network language model to DBMS fuzzing, using a sequence model to generate test cases automatically. The authors note few studies had taken this route, and highlight its suitability for black-box testing. Evaluated on SQLite, the tool generated valid test cases and achieved higher code coverage than its initial training set. Written by claude-opus-5 from the 4 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited, not used; nothing in the mentions describes reusing its code.

extends technique — no

No technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer is reported in the mentions.

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

SQLancer publications it cites (3)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
19	Rigger M, Su Z. Testing database engines via pivoted query synthesis[C]//14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20). 2020: 667-682.	sqlancer publication · PQS
20	Rigger M, Su Z. Detecting optimization bugs in database engines via non-optimizing reference engine construction[C]//Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium ...	sqlancer publication · NOREC
21	Rigger M, Su Z. Finding bugs in database systems via query partitioning[J]. Proceedings of the ACM on Programming Languages, 2020, 4(OOPSLA): 1-30.	sqlancer publication · TLP

Every place it refers to SQLancer (4)

4 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	When a correctness error is triggered, the DBMS does not crash, but the query returns incorrect query results [18, 19, 20, 21].	citation marker background	A DBMS Fuzzing page 1
M2	PQS[19] selects the pivot row in advance, and then constructs the SQL query based on the pivot row.	technique definition	A DBMS Fuzzing page 2
M3	NoREC [20] transforms the SQL query into an equivalent form that will not be optimized by the query optimizer, and then executes the original query and the equivalent form separately.	technique definition	A DBMS Fuzzing page 2
M4	Query Partitioning [21] uses ternary logical partitioning to convert the original query into three partitioned queries, and compares whether the results of the original query are consistent with the union of the partitioned queries.	technique definition	A DBMS Fuzzing page 2

This page is rendered from _data/papers/paper_doi_10_1109_dsc55868_2022_00057.json, extracted from supplied pdf. 8 pages, 32 references parsed.