一句话：提出 Thanos，通过存储引擎轮换构造等价 DBMS 进行差分测试，自动发现数据库系统缺陷。
差分测试是自动化 DBMS 测试中建立测试预言（test oracle）的常用策略，但人工挑选实现多样且输入语法兼容的等价 DBMS 成本很高。本文提出 Thanos，其核心洞察是：同一 DBMS 的不同存储引擎必须在基本存储功能上保持一致，因此可通过存储引擎轮换来构造等价 DBMS。Thanos 依次完成存储引擎选择、等价信息提取、面向特性的测试用例合成，并将用例发送到采用不同存储引擎的 DBMS 并比较结果。作者在 MySQL、MariaDB 和 Percona 上与 SQLancer、SQLsmith、SQUIRREL 对比，分支覆盖率提升 24%–116%，发现其他 fuzzer 遗漏的缺陷；厂商确认 32 个此前未知缺陷，其中 29 个为 Critical。
Differential testing is a prevalent strategy for establishing test oracles in automated DBMS testing. However, meticulously selecting equivalent DBMSs with diverse implementations and compatible input syntax requires huge manual efforts. In this paper, we propose Thanos, a framework that finds DBMS bugs via storage engine rotation based differential testing. Our key insight is that a DBMS with different storage engines must provide consistent basic storage functionalities. Therefore, it's feasible to construct equivalent DBMSs based on storage engine rotation, ensuring that the same SQL test cases to these equivalent DBMSs yield consistent results. The framework involves four main steps: 1) select the appropriate storage engines; 2) extract equivalence information among the selected storage engines; 3) synthesize feature-orient test cases that ensure the DBMS equivalence; and 4) send test cases to the DBMSs with selected storage engines and compare the results. We evaluate Thanos on three widely used and extensively tested DBMSs, namely MySQL, MariaDB, and Percona against state-of-the-art fuzzers SQLancer, SQLsmith, and SQUIRREL. Thanos outperforms them on branch coverage by 24%-116%, and also finds many bugs missed by other fuzzers. More importantly, the vendors have confirmed 32 previously unknown bugs found by Thanos, with 29 verified as Critical.
DOI 原文 ·
@inproceedings{paperbot8762,
title = {Thanos: DBMS Bug Detection via Storage Engine Rotation Based Differential Testing},
author = {Ying Fu and Zhiyong Wu and Yuanliang Zhang and Jie Liang and Jingzhou Fu and Yu Jiang and Shanshan Li and Xiangke Liao},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00257}
}