TSGuard: Detecting Logic Bugs in Time Series Management Systems Via Time Series Algebra
Read the paper · doi:10.1109/icsme64153.2025.00030
What this paper does with SQLancer
SQLancer is TSGuard's baseline, and the paper is explicit about the form that takes: it adapted SQLancer, an open-source relational database testing tool, as a baseline for comparison. The two were run for 7200 seconds against the same three systems, with TSGuard finding 38 bugs to SQLancer's 7 and generating several times more valid queries. NoREC, TLP, PQS and QPG are each described in the discussion of metamorphic testing's limits, which is where the paper argues that oracles built for relational queries do not transfer to time-series ones. The adaptation is what made a relational tool runnable on these systems for the comparison, not a contribution TSGuard claims.
TSGuard detects logic bugs in time series management systems using a time series algebra: queries are rewritten into algebraically equivalent forms whose results must agree, with the rewriting rules defined over time-series operations rather than relational ones. Its motivation is that relational metamorphic oracles do not carry over, since time-series query languages have constructs those oracles cannot express. On InfluxDB, IoTDB and TDengine it found 38 bugs.
How it was classified
uses infrastructure — no
M5 describes adapting SQLancer so it could be run as a baseline. That is work done to make the comparison possible, not TSGuard's own implementation being built on SQLancer -- its algebra and generator are its own.
extends technique — no
Adapting the tool in order to run it as a baseline is comparison, not extension. TSGuard's contribution is a time series algebra, and the paper presents NoREC, TLP and PQS as relational oracles whose assumptions do not carry to time-series systems rather than as techniques it generalises.
compares with — yes
M5 states SQLancer was adapted as a baseline for comparison, M7 gives the per-system table of bugs and query counts for both tools, and M8 reports 38 bugs against SQLancer's 7.
Comparison with Other Techniques To evaluate the effectiveness of TSGuard in detecting logic bugs in TSMSs, we adapted the open-source relational database testing tool SQLancer as a baseline for comparison.
MetricsSQLancer TSGuard InfluxDB IotDB TDengine InfluxDB IotDB TDengine Bugs 2 2 3 12 9 17 Sequences 3805 42653 118889 178232 413218 222726 Valid Queries23243 114024 95007 196583 447972 264704 Invalid Queries376 27401 132957 1905 48253 11502 Table V presents the results from the 7200-second experiment, comparing TSGuard and SQLancer in terms of bug detection, syntax node sequence generation, and query validity.
The results show that TSGuard detected 38 bugs across the three TSMSs, whereas SQLancer detected only 7.
describes as state of the art — no
SQLancer is described as an open-source relational database testing tool; the paper makes no claim about it being the state of the art.
Where this differs from the pattern checks
The regular expressions that scan for these relationships are advisory. Where the reading above contradicts one, the reason is recorded.
extends_technique matched on adapted SQLancer
The regex sees an adaptation verb next to the tool name. The sentence continues 'as a baseline for comparison', which makes it the opposite: the tool was modified so it could be measured against, not built upon.
The regex sees an adaptation verb next to the tool name. The sentence continues 'as a baseline for comparison', which makes it the opposite: the tool was modified so it could be measured against, not built upon.
Its artifact
LingweiKuang/TSGuard carries renamed sqlancer package, sqlancer source content match.
Repository names this paper.
source
TSGuard: Detecting Logic Bugs in Time Series Management Systems via Time Series Algebra # TSGuard-Detecting-Logic-Bugs-in-Time-Series-Management-Systems-via-Time-Series-Algebra TSGuard: Detecting Logic Bugs in Time Series Management Systems via Time Series Algebra
source
TSGuard/tsFuzzy/src/main/java/com/fuzzy/Randomly.java is SQLancer's Randomly.java, with the package renamed to com.fuzzy (8 of 8 identifiers match: StringGenerationStrategy, SOPHISTICATED, cachedLongs, cachedStrings, cachedDoubles).
source
private static StringGenerationStrategy stringGenerationStrategy = StringGenerationStrategy.SOPHISTICATED;
source
SQLancer publications it cites (4)
Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.
| # | Entry | Matched as |
|---|---|---|
| 10 | Manuel Rigger and Zhendong Su. 2020. Detecting optimization bugs in database engines via non-optimizing reference engine construction. In Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conf... | sqlancer publication · NOREC |
| 11 | Manuel Rigger and Zhendong Su. 2020. Finding bugs in database systems via query partitioning. Proc. ACM Program. Lang. 4, OOPSLA, Article 211 (November 2020), 30 pages. https://doi.org/10.1145/3428279 | sqlancer publication · TLP |
| 12 | Manuel Rigger and Zhendong Su. 2020. Testing database engines via pivoted query synthesis. In Proceedings of the 14th USENIX Conference on Operating Systems Design and Implementation (OSDI'20). USENIX Association, USA... | sqlancer publication · PQS |
| 28 | J. Ba and M. Rigger, "Testing Database Engines via Query Plan Guidance," Engineering (ICSE), Melbourne, Australia, 2023, pp. 2060-2071, doi: 10.1109/ICSE48619.2023.00174. | sqlancer publication · QPG |
Every place it refers to SQLancer (18)
18 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.
| Id | Sentence | Found by | Where |
|---|---|---|---|
| M1 | For example, NoREC [10] detects logic bugs in database optimizers by mutating the original query into a non-optimized query and comparing their result sets. |
technique |
C Limitations of Metamorphic Testing page 2 |
| M2 | Similarly, TLP[11] mutates the original query into multiple partitioned queries, reassembles their result sets, an d verifies consistency with the original result set to detect logic bugs. |
technique |
C Limitations of Metamorphic Testing page 2 |
| M3 | For instance, PQS [12] synthesizes a query Qbased on an expected result set (i. |
technique |
C Limitations of Metamorphic Testing page 2 |
| M4 | Comparison of the growth trend of syntax node sequences and valid queries during TSGuard and SQLancer runs. |
name |
C The Effectiveness of the Feedback Mechanism and Query page 9 |
| M5 | Comparison with Other Techniques To evaluate the effectiveness of TSGuard in detecting logic bugs in TSMSs, we adapted the open-source relational database testing tool SQLancer as a baseline for comparison. |
name |
D Comparison with Other Techniques page 9 |
| M6 | Metrics recorded after TSGuard and SQLancer run 7200 seconds. |
name |
D Comparison with Other Techniques page 9 |
| M7 | MetricsSQLancer TSGuard InfluxDB IotDB TDengine InfluxDB IotDB TDengine Bugs 2 2 3 12 9 17 Sequences 3805 42653 118889 178232 413218 222726 Valid Queries23243 114024 95007 196583 447972 264704 Invalid Queries376 27401 132957 1905 48253 11502 Table V presents the results from the 7200-second experiment, comparing TSG... |
name |
D Comparison with Other Techniques page 9 |
| M8 | The results show that TSGuard detected 38 bugs across the three TSMSs, whereas SQLancer detected only 7. |
name |
D Comparison with Other Techniques page 9 |
| M9 | 91 times more valid queries than SQLancer, while generating only 38. |
name |
D Comparison with Other Techniques page 9 |
| M10 | Figure 9 illustrates the growth trends of syntax node sequences and valid queries for TSGuard and SQLancer over 7200 seconds. |
name |
D Comparison with Other Techniques page 9 |
| M11 | The comparison shows that TSGuard consistently outperformed SQLancer in both metrics across all target TSMSs. |
name |
D Comparison with Other Techniques page 9 |
| M12 | 95 times more valid queries than SQLancer. |
name |
D Comparison with Other Techniques page 9 |
| M13 | 83 times more valid queries than SQLancer. |
name |
D Comparison with Other Techniques page 9 |
| M14 | 47 times more valid queries than SQLancer. |
name |
D Comparison with Other Techniques page 9 |
| M15 | PQS [12] randomly selects specific rows from the database and synthesizes test cases, verifying that the results of these test cases contain the selected rows to detect logic bugs. |
technique |
E Resource Cost of TSGuard page 11 |
| M16 | TLP [11] partitions a query into multiple partitioned queries, verifying that the combined results of these partitioned queries remain consistent with the results of original query. |
technique |
E Resource Cost of TSGuard page 11 |
| M17 | NOREC [10] transforms an original query into a non-optimized but semantically equivalent SQL query, detecting logic bugs by comparing their execution results. |
technique |
E Resource Cost of TSGuard page 11 |
| M18 | QPG [28] guides database state mutation using query plans and applies logic bug oracles to identify logic bugs across various database states. |
technique |
E Resource Cost of TSGuard page 11 |