一句话:提出免语法依赖的 DBMS 模糊测试思路 Griffin,旨在降低跨不同 DBMS 的模糊测试适配成本。
论文关注 DBMS 模糊测试中的语法依赖问题。由于 DBMS 会对输入进行严格校验,现有模糊测试通常借助语法生成语法和语义正确的 SQL 语句,以提高测试效率;但不同 DBMS 的复杂语法差异巨大,使模糊测试器难以适配到新的 DBMS,而大量 DBMS 仍未得到充分测试。为此,作者提出 Griffin,一种无需语法依赖的 DBMS 模糊测试方法/框架,目标是摆脱对特定 DBMS 语法的绑定,从而更易适配和测试各类 DBMS。摘要主要阐述了动机与目标,未展开 Griffin 的具体生成或变异机制,也未报告实验评估与关键结果。
Fuzzing is a promising approach to DBMS testing. One crucial component in DBMS fuzzing is grammar: since DBMSs enforce strict validation on inputs, a grammar improves fuzzing efficiency by generating syntactically- and semantically-correct SQL statements. However, due to the vast differences in the complex grammar of various DBMSs, it is painstaking to adapt these fuzzers to them. Considering that lots of DBMSs are not yet well tested, there is an urgent need for an effective DBMS fuzzing approach that is free from grammar dependencies.