SQLaser：基于子句引导模糊测试检测数据库管理系统逻辑缺陷
SQLaser: Detecting DBMS Logic Bugs with Clause-Guided Fuzzing
AI总结：
SQLaser提出以SQL子句组合和易出错函数链为引导的定向模糊测试方法，在四种DBMS上检测逻辑缺陷，并将发现时间降低约60%。
摘要：
数据库管理系统（DBMSs）是现代数据驱动系统中的关键组成部分。其复杂性常常导致逻辑缺陷，即DBMS内部的实现错误，这些错误可能导致错误的查询结果、数据泄露、未授权访问等，而不一定引发可见的系统故障。现有检测采用两种策略：基于规则的缺陷检测和覆盖率引导的模糊测试。总体而言，规则规范本身具有挑战性；因此，基于规则的检测仅限于特定且简单的规则。覆盖率引导的模糊测试盲目探索代码路径或代码块，其中许多路径或代码块不太可能包含逻辑缺陷；因此，该策略成本效益较低。在本文中，我们设计了SQLaser，一种以SQL子句为导向的模糊测试器，用于检测DBMS中的逻辑缺陷。通过对四种不同DBMS中大多数现有逻辑缺陷的全面检查（排除导致系统崩溃的缺陷），我们识别出35种逻辑缺陷模式。这些模式表现为某些通常导致逻辑缺陷的SQL子句组合，而这些子句组合背后是一系列函数。因此，我们将逻辑缺陷模式建模为易出错的函数链（即函数序列）。我们进一步开发了一种定向模糊测试器，并采用新的路径到路径距离计算机制，以有效测试这些函数链并发现更多逻辑缺陷。该机制使SQLaser能够快速导航到目标位置，并发现由这些路径产生的潜在缺陷。我们在SQLite、MySQL、PostgreSQL和TiDB上进行的评估表明，与其他模糊测试方法相比，SQLaser显著加速了缺陷发现，检测时间减少了约60%。
英文摘要：
Database Management Systems (DBMSs) are vital components in modern data-driven systems. Their complexity often leads to logic bugs, which are implementation errors within the DBMSs that can lead to incorrect query results, data exposure, unauthorized access, etc., without necessarily causing visible system failures. Existing detection employs two strategies: rule-based bug detection and coverage-guided fuzzing. In general, rule specification itself is challenging; as a result, rule-based detection is limited to specific and simple rules. Coverage-guided fuzzing blindly explores code paths or blocks, many of which are unlikely to contain logic bugs; therefore, this strategy is cost-ineffective. In this paper, we design SQLaser, a SQL-clause-guided fuzzer for detecting logic bugs in DBMSs. Through a comprehensive examination of most existing logic bugs across four distinct DBMSs, excluding those causing system crashes, we have identified 35 logic bug patterns. These patterns manifest as certain SQL clause combinations that commonly result in logic bugs, and behind these clause combinations are a sequence of functions. We therefore model logic bug patterns as error-prone function chains (ie, sequences of functions). We further develop a directed fuzzer with a new path-to-path distance-calculation mechanism for effectively testing these chains and discovering additional logic bugs. This mechanism enables SQLaser to swiftly navigate to target sites and uncover potential bugs emerging from these paths. Our evaluation, conducted on SQLite, MySQL, PostgreSQL, and TiDB, demonstrates that SQLaser significantly accelerates bug discovery compared to other fuzzing approaches, reducing detection time by approximately 60%.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
