一句话：提出 Unicorn，用混合输入合成与主动异常检测对时序数据库做模糊测试，发现 42 个此前未知的 bug。
时序数据库广泛应用于安全攸关的物联网领域，对其正确性与安全性要求严格。模糊测试已在关系数据库中发现大量 bug，但难以直接用于时序数据库：查询规格不匹配导致大部分时序逻辑不可达，而异常被隐式处理又使严重 bug 难以暴露。为此，作者提出 Unicorn：一方面设计混合输入合成，生成既覆盖时序特性又保证语法正确的高质量查询；另一方面采用主动异常检测，挖掘隐藏在隐式异常处理背后的细微症状 bug。在 IoTDB、KairosDB、TimescaleDB、TDEngine、QuestDB 与 GridDB 上，Unicorn 的基本块覆盖率相比 SQLsmith 和 SQLancer 分别提升 21%–199% 和 34%–693%，并发现 42 个此前未知的 bug。
The ubiquitous use of time-series databases in the safety-critical Internet of Things domain demands strict security and correctness. One successful approach in database bug detection is fuzzing, where hundreds of bugs have been detected automatically in relational databases. However, it cannot be easily applied to time-series databases: the bulk of time-series logic is unreachable because of mismatched query specifications, and serious bugs are undetectable because of implicitly handled exceptions. In this paper, we propose Unicorn to secure time-series databases with automated fuzzing. First, we design hybrid input synthesis to generate high-quality queries which not only cover time-series features but also ensure grammar correctness. Then, Unicorn uses proactive exception detection to discover minuscule-symptom bugs which hide behind implicit exception handling. With the specialized design oriented to time-series databases, Unicorn outperforms the state-of-the-art database fuzzers in terms of coverage and bugs. Specifically, Unicorn outperforms SQLsmith and SQLancer on widely used time-series databases IoTDB, KairosDB, TimescaleDB, TDEngine, QuestDB, and GridDB in the number of basic blocks by 21%-199% and 34%-693%, respectively. More importantly, Unicorn has discovered 42 previously unknown bugs.
@inproceedings{paperbot7433,
title = {Unicorn: detect runtime errors in time-series databases with hybrid input synthesis},
author = {Zhiyong Wu and Jie Liang and Mingzhe Wang and Chijin Zhou and Yu Jiang},
booktitle = {ISSTA},
year = {2022},
doi = {10.1145/3533767.3534364}
}