Semantic Hint-Based Fuzzing for Time-Series Databases

Panta Kittisatra, Liang Liu. 2025. 2025 7th International Academic Exchange Conference on Science and Technology Innovation (IAECST).

Read the paper · doi:10.1109/iaecst68792.2025.11415166

What this paper does with SQLancer

SQLancer is the pioneer the paper builds from and the limitation it works around: it is credited with pioneering systematic bug detection through oracles such as NoREC and TLP, and then said to assume relational semantics, static schemas and Boolean logic, which is what makes it ineffective for time-series data. This paper adds a semantic hint-based oracle to TSGuard for testing time-series databases, arguing that existing fuzzing frameworks are built for relational DBMSs and ignore the temporal semantics and query processing peculiar to time-series systems. The oracle injects logically neutral predicates such as tautologies and redundant conditions into a baseline query and compares results differentially, so query intent is unchanged but robustness is probed. On Apache IoTDB, InfluxDB and TDengine it surfaced several optimizer-related crashes. Written by claude-opus-5 from the 5 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited, not used; nothing in the mentions describes reusing its code.

extends technique — no

No technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer is reported in the mentions.

describes as state of the art — yes

M4 credits SQLancer with pioneering systematic bug detection using oracles such as NoREC and TLP, which is a claim about its standing in the field rather than a description of a method.

SQLancer pioneered systematic bug detection using oracles such as Non-Optimizing Reference Engine Construction (NoREC) and Ternary Logic Partitioning (TLP), enabling reliable detection of logic bugs even when databases do not crash [6]. M4 · II RELATED WORK · page 2

SQLancer publications it cites (2)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
6	M. Rigger and Z. Su, “Finding bugs in database systems via query partitioning,” Proc. ACM Program. Lang., vol. 4, no. OOPSLA, pp. 1– 30, 2020.	sqlancer publication · TLP
14	M. Rigger and Z. Su, “Testing database engines via pivoted query synthesis,” in 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20), 2020, pp. 667– 682.	sqlancer publication · PQS

Every place it refers to SQLancer (5)

5 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	Tools such as SQLancer [6], SQLaser [7], and mutation -based engines like AF L leverage metamorphic testing to uncover logic bugs and optimizer inconsistencies [8], [9].	name background	I INTRODUCTION page 1
M2	However, these frameworks largely assume relational semantics [6], static schemas, and Boolean logic evaluation, making them ineffective for dealing with temporal operators, continuous data ingestion, window functions, and time -aware aggregations that are fundamental in TSDBs.	citation marker motivation	I INTRODUCTION page 1
M3	RELATED WORK Research on testing relational DBMS, which supports a standardized query language SQL, has evolved considerably over the past decades [13], [14].	citation marker background	II RELATED WORK page 1
M4	SQLancer pioneered systematic bug detection using oracles such as Non-Optimizing Reference Engine Construction (NoREC) and Ternary Logic Partitioning (TLP), enabling reliable detection of logic bugs even when databases do not crash [6].	name state of the art	II RELATED WORK page 2
M5	Later frameworks such as SQLaser, Kangaroo, and Pivoted Query Synthesis (PQS) extended equivalence based testing using clause -guided strategies and optimizer aware synthesis to reveal subtle logical faults in popular relational systems including MySQL [15], PostgreSQL [16], and SQLite [17].	technique background	II RELATED WORK page 2

This page is rendered from _data/papers/paper_doi_10_1109_iaecst68792_2025_11415166.json, extracted from supplied pdf. 7 pages, 18 references parsed.