基于大语言模型合成SQL特征的自动化数据库测试
Automated Database Testing via LLM-Synthesized SQL Features
AI总结：
该研究提出ShQveL方法，通过LLM合成SQL特征增强SQL生成器，在5个DBMS上发现55个新漏洞，其中50个已被修复，提升了自动化数据库测试的漏洞发现能力。
摘要：
数据库管理系统（DBMS）已通过多种自动化测试方法进行测试，其中许多方法会生成等价查询对，以识别导致DBMS计算错误结果的漏洞，并已在成熟、广泛使用的DBMS中发现了数百个漏洞。大多数此类方法基于手动编写的SQL生成器，但它们的漏洞发现能力受到生成器支持的SQL特征有限的限制。在这项工作中，我们提出了ShQveL，一种通过利用大语言模型（LLM）合成SQL片段来增强现有SQL测试用例生成器的方法。我们的核心思路是将通过与LLM自动交互获得的SQL特征系统地融入SQL生成器，在有效生成测试用例的同时扩大覆盖的特征范围。具体而言，ShQveL使用SQL草图——带有不完整代码段、由LLM填充的SQL语句——将LLM生成的内容整合到生成器中。我们在5个DBMS上对ShQveL进行了评估，发现了55个独特且此前未知的漏洞，其中50个在我们报告后立即得到修复。
英文摘要：
Database Management Systems (DBMSs) have been tested by various automated testing approaches. Many of them generate pairs of equivalent queries to identify bugs that cause DBMSs to compute incorrect results, and have found hundreds of bugs in mature, widely used DBMSs. Most such approaches are based on manually written SQL generators; however, their bug-finding capabilities remain constrained by the limited set of SQL features supported by the generators. In this work, we propose ShQveL, an approach that augments existing SQL test-case generators by leveraging Large Language Models (LLMs) to synthesize SQL fragments. Our key idea is to systematically incorporate SQL features gained through automated interactions with LLMs into the SQL generators, increasing the features covered while efficiently generating test cases. Specifically, ShQveL uses SQL sketches---SQL statements with incomplete code segments that LLMs fill---to integrate LLM-generated content into the generator. We evaluated ShQveL on 5 DBMSs and discovered 55 unique and previously unknown bugs, 50 of which were promptly fixed after our reports.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
