Parameter sensitive database fuzz testing method and system based on combinatorial testing

Abstract

The invention discloses a parameter sensitive database fuzzy testing method and system based on combination testing, and the method comprises the steps: obtaining a coverage basic block set of each parameter through static taint analysis, generating a weight value of each parameter, and further determining a priority parameter combination set; training the condition generation probability of each SQL characteristic class under specific parameters through coverage rate feedback, and constructing a test sample generation scheme corresponding to the parameters; and finally, generating parameters and corresponding test samples through the weight data generated in the training stage, and checking execution results of the test samples through an oracle machine. According to the method, the parameter weight and the characteristic generation probability are adjusted through static analysis and the code coverage rate, intelligent scheduling of high-value test paths is achieved, the test efficiency and the coverage rate are improved, meanwhile, the problem of parameter combination space explosion is solved, and an innovative solution is provided for quality assurance and performance optimization of a database system.

Description

Technical Field

[0001] This invention belongs to the technical field of automated testing of database management systems, and mainly relates to a fuzzy testing method and system for parameter-sensitive databases based on combined testing. Background Technology

[0002] Database management systems, as core components of modern information processing, are crucial to business operations due to their stability and performance. However, with increasing database complexity and diversified application scenarios, traditional testing methods face numerous challenges.

[0003] First, parameterized query testing suffers from insufficient coverage. Traditional methods typically use default or random parameter values ​​to generate test cases, failing to effectively cover all potential execution paths. For example, while SQL Server's Parameter Sensitive Plan Optimization (PSP) technology can generate multiple active cache plans for parameterized queries, it only supports scheduling a maximum of three predicates, and manual hints are required.

[0004] Furthermore, the explosion of test space in combinatorial testing limits testing efficiency. Traditional combinatorial testing tools, such as PICT, generate a number of test cases that grow exponentially with the strength of parameter combinations. For example, for pairwise combinations of five parameters, PICT generates 31 test cases; for three-parameter combinations, it requires 121 cases; and for five-parameter combinations, it requires a staggering 720 cases. Research shows that 93% of errors can be detected by two-parameter combinations, and over 98% by three-parameter combinations, but the explosive growth in the number of test cases significantly reduces testing efficiency.

[0005] Finally, fuzzing tools perform poorly in database testing. Existing fuzzing tools such as AFL generate only 30% of the SQL statements in database tests with correct syntax, and less than 5% with correct semantics. Even dedicated database fuzzing tools such as SQLSmith suffer from insufficient syntax and semantic correctness, resulting in a large number of invalid test cases.

[0006] In the prior art, patent CN120372633A discloses a database fuzzing method based on deep feedback and semantic preservation. This method collects standard query templates to set a mutation rule base, generates mutation strategies through a mutation strategy generator, sends the mutation strategies to the target database for fuzzing, and further records the target database's response information to the mutation strategies. Furthermore, it obtains response information in real time through a deep feedback mechanism to dynamically optimize the mutation strategies; generates test cases through a semantic preservation strategy; and dynamically adjusts the priority of test tasks and allocates resources through an intelligent scheduling module. However, this method only focuses on the correctness of SQL statement CRUD operations, neglecting the impact of the large number of parameters and parameter combinations on the database state. Therefore, it can only verify the security of the database under limited conditions and cannot meet the needs of modern complex database systems for high-quality fuzzing.

[0007] Patent CN116909884A discloses a database fuzzing method for configuration defects. It constructs a database fuzzing system consisting of a configuration taint analysis module, a configuration instrumentation module, and a database fuzzing module. The configuration taint analysis module obtains the influence range of the target configuration and the set of mapping relationships between configurations and basic program blocks. The configuration instrumentation module reads the source code of the software under test and the set of configuration-to-basic program block mapping relationships to instrument the software source code. The database fuzzing module performs coverage-guided gray-box fuzzing on the instrumented software. For seeds executing configured code, it uses a configuration-oriented two-phase mutation strategy to penetrate configuration control branch conditions and outputs a set of configuration defects. However, this method only tests a small portion of the parameters in the database and does not explore the vast and complex parameter combination space in the database. This results in insufficient comprehensiveness and accuracy of the test, failing to effectively discover potential security risks and performance problems caused by parameter combinations in the database, and making it difficult to adapt to the complex and ever-changing operating environment and security requirements of modern database systems.

[0008] In summary, current work and published patents in the field of database fuzzing still have at least the following unresolved issues:

[0009] (1) In terms of parameter coverage, existing methods are difficult to fully cover the huge and complex parameter combination space in the database, resulting in blind spots in testing and failing to effectively discover potential problems caused by improper parameter combinations.

[0010] (2) Regarding the validity of test cases, existing fuzzing tools generate SQL statements in database testing with insufficient syntactic and semantic correctness, resulting in a large number of invalid test cases and reducing the accuracy and efficiency of testing.

[0011] (3) In terms of the comprehensiveness of the test, existing methods often only focus on certain specific aspects of the database, such as the correctness of SQL statements or configuration defects, while ignoring the testing of other important factors in the database, such as the impact of parameter combinations on the database status, thus making it difficult to comprehensively evaluate the security and performance of the database. Summary of the Invention

[0012] This invention addresses the problems of existing technologies by providing a parameter-sensitive database fuzz testing method and system based on combinatorial testing. It obtains a set of basic coverage blocks for each parameter through static taint analysis, generates a weight value for each parameter, and further determines a set of preferred parameter combinations. Through coverage feedback training, it trains the conditional generation probability of each SQL feature class under specific parameters, constructing a test case generation scheme for each parameter. Finally, using the weight data generated during the training phase, it generates parameters and corresponding test cases, and verifies the test case execution results using an oracle. This invention adjusts parameter weights and feature generation probabilities through static analysis and code coverage, achieving intelligent scheduling of high-value test paths, improving testing efficiency and coverage, and simultaneously solving the parameter combination space explosion problem, providing an innovative solution for database system quality assurance and performance optimization.

[0013] To achieve the above objectives, the technical solution adopted by the present invention is: a fuzz testing method for parameter-sensitive databases based on combined testing, comprising the following steps:

[0014] S1: Obtain the set of basic code blocks covering each parameter through static taint analysis, generate the initial weight value of each parameter, construct a binary parameter weight matrix, and select the binary parameter combination with the highest total weight as the high-priority test combination;

[0015] S2: Calculate mutual information and novelty scores through coverage feedback, determine the weight of each SQL feature under the given parameter, evaluate the importance of the feature under the specific parameter, and construct a test case generation scheme corresponding to the parameter.

[0016] S3: Based on the weights generated in steps S1 and S2, generate parameters and corresponding test cases, and use them... The -greedy strategy dynamically balances the exploration and utilization phases of fuzz testing and verifies the test case execution results through an oracle.

[0017] As an improvement to the present invention, in step S1, the initial weight value is calculated based on the number of basic blocks covered by each parameter, and a 2-wise combination test strategy is adopted. A binary parameter weight matrix is ​​constructed in the combination space, where N is the total number of database parameters; the binary parameter weight matrix includes the sum of the basic weights of each parameter and the synergistic effect weight of the joint execution of the two parameters.

[0018] As another improvement to the present invention, in step S1, the sum of the basic weights of each parameter Specifically:

[0019]

[0020] in, Parameters , The initial weight values;

[0021] The synergistic effect weights of the two parameters being jointly executed Specifically:

[0022]

[0023] in, , For parameters , A collection of basic code blocks that are covered.

[0024] As another improvement of the present invention, in step S2, mutual information is used to quantify the statistical dependency relationship between SQL characteristics and program execution edges, specifically as follows:

[0025]

[0026] in, For parameters Next,Characteristics and edge The probability of them occurring simultaneously For parameters Next,Characteristics The probability of occurrence For parameters below The probability of being covered;

[0027] The novelty score is calculated as follows:

[0028]

[0029] in, For parameters below The number of times an edge is covered is calculated by taking the reciprocal of the formula, which gives higher scores to edges that are covered less often, i.e., paths that have not been fully explored.

[0030] The specific method for calculating the weight values ​​of each SQL feature is as follows:

[0031] .

[0032] As another improvement of the present invention, in step S2, the weight value of each SQL feature is normalized to obtain the final condition generation probability of each SQL feature class under specific parameters, and the weights of all SQL features are converted into a probability distribution to ensure that the generated test cases conform to the probability distribution law, specifically:

[0033]

[0034] in, For the parameters calculated in the previous step SQL features The weight value, This represents the total number of SQL features.

[0035] As another improvement of the present invention, in step S3... The specific dynamic selection method of the -greedy strategy is as follows: during initial testing, a high probability is used... Explore unknown parameter combinations and dynamically decrease them as the test time increases. The size of the value gradually increases the probability of utilizing existing priority parameter combinations; the dynamic decay of the exploration rate is specifically as follows:

[0036]

[0037] in, This is the initial exploration rate; Minimum exploration rate; This is the decay time constant.

[0038] As a further improvement of the present invention, the oracle mechanism in step S3 includes a differential oracle and a metamorphic oracle. The differential oracle compares the execution results of different database management systems on the same test sample. The metamorphic oracle generates an equivalent variant query and compares whether the execution results of the original query and the variant query are consistent.

[0039] To achieve the above objectives, the present invention also adopts the following technical solution: a parameter-sensitive database fuzz testing system based on combined testing, comprising a computer program, wherein the computer program, when executed by a processor, implements the steps of the method as described in any one of claims 1-7 above.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] (1) This invention solves the problem that existing methods cannot fully cover the vast parameter combination space in the database. The method of this invention adopts a combination of dynamic and static analysis techniques. First, it screens and determines an initial set of high-value priority parameter combinations. Based on this, it further introduces... The "-greedy exploration-" strategy enables dynamic analysis and continuous updating of the preferred parameter combination set. This strategy not only fully utilizes known high-value parameter combinations but also conducts extensive and in-depth exploration of unknown parameter combinations, thereby ensuring full coverage of the broad parameter space within the database and significantly improving the global exploration capability and coverage efficiency of parameter combinations.

[0042] (2) This invention improves the effectiveness of test cases during database fuzzing. First, this method quantitatively evaluates the correlation between various SQL features and the database program execution edges under specific parameter conditions. Based on the evaluation results, it dynamically adjusts the generation probability of each SQL feature under different parameter configurations. On this basis, it combines dictionary-based SQL fragment generation technology and a structured construction algorithm for abstract syntax trees to achieve test case generation with high syntactic correctness and semantic rationality. This comprehensive strategy not only ensures that the generated test cases strictly meet the preset parameter requirements but also effectively enhances the coverage and error detection capability of fuzzing, thereby significantly improving the efficiency and reliability of the testing process.

[0043] (3) This invention effectively enhances the comprehensiveness of database fuzz testing. This method incorporates the core ideas of parametric fuzz testing into the database fuzz testing process, designing and implementing an efficient parameter combination selection algorithm. This algorithm, through systematically generating and filtering parameter combinations, can perform more comprehensive and in-depth testing of various database behaviors under different parameter configurations. This method not only improves the coverage of test cases but also better simulates the complex usage scenarios of databases in real-world application environments, thereby significantly improving the depth and breadth of testing and significantly increasing the code coverage of database fuzz testing. Attached Figure Description

[0044] Figure 1 This is a schematic diagram of the steps of the method of the present invention;

[0045] Figure 2 This is a flowchart illustrating the database fuzzing method based on combinatorial testing in this paper.

[0046] Figure 3 This method - A diagram illustrating the Greedy dynamic balancing strategy. Detailed Implementation

[0047] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are for illustrative purposes only and are not intended to limit the scope of the invention.

[0048] Example 1

[0049] A parameter-sensitive database fuzzing method based on combinatorial testing, such as Figure 1 As shown, it includes the following steps:

[0050] Step S1: Obtain the set of basic coverage blocks for each parameter through static taint analysis, generate the weight value of each parameter, and then construct a binary parameter weight matrix, maintaining the weight combination with higher weight value as the preferred combination; when constructing the binary parameter weight matrix, the arithmetic mean of the single parameter weight and the parameter co-weight value are considered at the same time.

[0051] The system introduces static analysis tools to perform data dependency flow and control dependency flow taint analysis on each parameter, and obtains the set of basic blocks it covers. Based on the obtained set of basic blocks for each parameter, the system determines the basic weight value corresponding to each parameter according to the number of basic blocks for each parameter. Based on the 2-wise coverage concept in parameter combination selection, in This method involves targeted exploration and analysis of parameter combinations within the parameter space. It fully considers the basic weight of each individual parameter while introducing synergistic effect weights between binary parameters, thus constructing a binary parameter weight matrix that reflects the interactive influence between parameters. This matrix is ​​used to systematically identify and maintain binary parameter combinations with higher weight values, marking them as priority combinations and providing a valid basis for subsequent parameter combination adjustments and selections.

[0052] like Figure 1 As shown in ①, for the selected target database management system, the system first obtains a list of all its dynamically configurable parameters through taint analysis, and then captures the set of basic code blocks covered by each parameter during its execution:

[0053]

[0054] Subsequently, based on the number of basic blocks covered by each parameter, the system calculates its initial weight value, as follows:

[0055]

[0056] After obtaining the initial weights of each parameter, the system further employs a 2-wise combination test strategy. Construct a binary parameter weight matrix in the combination space, where N is the total number of database parameters.

[0057]

[0058] The weight of each combination consists of two parts: the first part is the sum of the basic weights of each parameter. The second part is the synergistic effect weights resulting from the joint execution of the two parameters. This value is derived by counting the number of new basic blocks added by the joint coverage, in order to reflect the complementary enhancement effect between parameter combinations.

[0059] Ultimately, the system selects the top N binary parameter combinations with the highest total weight as high-priority test combinations. This method effectively reduces the size of test cases by focusing on parameter combinations that contribute the most to coverage, while still maintaining high code coverage, significantly improving the efficiency and effectiveness of database management system parameter configuration testing.

[0060] Step S2: Calculate mutual information and novelty score through coverage feedback, evaluate the importance of features under specific parameters, and construct a test case generation scheme corresponding to the parameters;

[0061] The system first employs code coverage analysis to quantitatively evaluate the correlation between various SQL features and database program execution edges under specific parameter conditions. Based on this evaluation, the system not only obtains the correlation between each SQL feature and the database program execution edge but also combines the novelty score of each edge. Through comprehensive calculation and weighted processing, it ultimately determines the specific weight value of each SQL feature under the given parameter conditions, thus providing more accurate guidance for the subsequent generation of sensitive test cases. The feature category weight calculation also includes the following constraints: excluding irrelevant features, such as management SQL features like CREATE and DELETE; classifying binary comparison operators, such as = and >, and logical operators, such as AND and OR, separately and calculating their weights independently.

[0062] For each SQL feature's weight value, a normalization process is used to convert it into a standardized condition generation probability, thereby accurately reflecting the relative importance and generation probability of each SQL feature class under specific parameter configurations.

[0063] The mutual information value of SQL features and edge coverage information is calculated through coverage feedback. High-frequency edges are penalized by calculating novelty scores. The feature class weights under parameter conditions are calculated using the mutual information value and novelty score, and the conditional generation probability of the SQL feature class under each parameter is calculated. Specifically, as follows... Figure 1 As shown in ②, for each parameter, the correlation between the SQL characteristics and the database program execution edge under that parameter condition is first evaluated. The evaluation method is as follows:

[0064]

[0065] in, For parameters Next,Characteristics and edge The probability of them occurring simultaneously For parameters Next,Characteristics The probability of occurrence For parameters below The probability of being covered.

[0066] Mutual information is used to quantify the statistical dependency between SQL characteristics and program execution edges. A larger value indicates a stronger correlation between the two, meaning that the parameters... Under the given conditions, generate this SQL feature. More likely to trigger a specific execution path This improves the effectiveness of testing. For example, if a certain SQL feature has high mutual information with a certain execution edge, such as high mutual information between complex conditions in the WHERE clause and the index scan path, it indicates that the feature has a significant impact on triggering specific behaviors under the current parameters.

[0067] After evaluating the relevance of all SQL features to the program execution edges, a novelty score is calculated for each edge to encourage the exploration of new paths. The novelty score is calculated as follows:

[0068]

[0069] This formula, by taking the reciprocal, gives higher scores to edges that are covered less often, meaning that paths that are not fully explored receive higher scores.

[0070] Based on the already calculated relevance between SQL features and database program execution edges, as well as the novelty score of each edge, the weight value of each SQL feature under the parameter conditions is further calculated as follows:

[0071]

[0072] Finally, the weight values ​​of each SQL feature under the calculated parameter conditions are normalized to obtain the final condition generation probability of each SQL feature class under specific parameters. The weights of all SQL features are then converted into a probability distribution to ensure that the generated test cases conform to the probability distribution law. The specific method is as follows:

[0073]

[0074] Step S3: Using the weight data generated in steps S1 and S2, generate parameters and corresponding test cases, and then use... - A fuzzy test execution of the greedy strategy for dynamic balancing of exploration and exploitation is performed, and the test case execution results are verified by an oracle.

[0075] pass The -greedy strategy dynamically selects the fuzzy testing mode for exploration and exploitation, selects the parameter combination using the maintained priority parameter combination, and calculates the joint feature selection probability by generating probability through the corresponding SQL feature conditions, and generates the final test case based on the joint feature selection probability. The greedy dynamic equilibrium exploration and utilization strategy is specifically manifested in the following way: In the initial testing phase, the system exhibits a high degree of... The system sets the exploration probability, prioritizing extensive exploration of unknown parameter combinations to fully uncover potential high-performance configurations. As the testing process progresses and accumulated data increases, the system will gradually reduce the probability according to a preset decay rule. The value, thus dynamically This mechanism adjusts the trade-off between exploration and utilization. Initially, the algorithm focuses on diverse attempts, while later it gradually emphasizes utilizing discovered efficient parameter combinations to achieve overall optimization efficiency and improved final performance, ensuring comprehensive testing across the entire test space.

[0076] Based on the selected parameter combinations, the system calculates the corresponding joint feature selection probability according to the conditional generation probability of each SQL feature class under specific parameter configurations. Then, based on this joint probability, the system constructs a parameter-sensitive SQL query statement with correct syntax and semantic logic. Finally, the system automatically sends the constructed SQL statement to the target database management system, which then executes the corresponding query operation.

[0077] The execution verification process primarily employs an oracle mechanism to examine the actual execution results of test samples. Oracles can be implemented using various methods; for example, differential oracles identify differences by comparing the output of the same query in different database management systems, or metamorphic oracles determine the consistency by executing multiple semantically equivalent queries and comparing their results. If the oracle detects unexpected or contradictory results, it may indicate a logical error in the tested system; conversely, if the database management system crashes unexpectedly or becomes unresponsive during execution, it clearly indicates a system-level crash. These two scenarios reveal potential defects in the system's functional correctness and operational stability.

[0078] like Figure 3 As shown, in the specific testing process, the following methods were adopted: The -greedy strategy dynamically balances the exploration and exploitation patterns during fuzzy testing, initially testing with a higher probability. Explore unknown parameter combinations, with 1- The probability is calculated using the priority parameter combination maintained in step S1, and dynamically decreased as the test time increases. The magnitude of the value gradually shifts the system towards a utilization mode, increasing the probability of utilizing existing preferred parameter combinations, and ultimately focusing on high-value parameter combinations. The dynamic decay of the exploration rate is expressed by the formula:

[0079]

[0080] in, The initial exploration rate determines the intensity of the initial exploration phase of the test. To minimize the exploration rate and ensure that basic exploration capabilities are retained in the later stages of testing, premature convergence should be avoided. The decay time constant is controlled. The rate of decline. Larger values ​​result in a more gradual decrease in the exploration rate, while smaller values ​​cause the system to quickly shift to exploitation mode. The advantage of this strategy is that it can fully explore the parameter space in the early stages of testing, avoiding getting trapped in local optima. As testing progresses, the system gradually focuses on parameter combinations that are more likely to generate high-quality test cases, thereby improving testing efficiency.

[0081] After selecting the initial parameter combination, the joint characteristic selection probability of the combination is determined based on the selected combination. The calculation method is as follows:

[0082]

[0083] in, The SQL characteristics calculated in step S2 are in a single parameter The conditional generation probability; For parameters The weight ratio in the current combination C is the result of weight normalization based on the priority parameter combination weights in step S1.

[0084] like Figure 2 As shown, the overall database fuzzing process of this method is as follows: the system randomly selects specific parameter values ​​from the selected parameter combinations, for example, max_connections=100. Based on the joint probability distribution... Randomly sample SQL features and construct syntactically correct and semantically reasonable SQL statements, such as SELECT * FROM table WHERE id=1, to test the target database management system.

[0085] Finally, the execution results of the test cases are verified using an oracle mechanism. The oracle can be a differential oracle or a metamorphic oracle. A differential oracle executes the same SQL statement in different database management systems, such as MySQL and PostgreSQL, and compares the output results. A metamorphic oracle verifies whether equivalent queries produce consistent results based on metamorphic relations (Mutation Relations). If the oracle detects output inconsistent with expectations, such as incorrect field types in the query results, it is marked as a logical error. If the database crashes during execution, such as due to a segmentation fault or memory overflow, it is marked as a crash error.

[0086] In summary, this invention discloses a parameter-sensitive database fuzzing method based on combinatorial testing, aiming to optimize parameter combination selection and test case generation in database management system fuzzing. This method uses a coverage feedback mechanism and a combination of dynamic and static methods to adjust parameter selection weights and the generation probability of parameter-related SQL statement characteristics, thereby achieving intelligent scheduling of high-value test paths. Simultaneously, it employs a collaborative fuzzing execution strategy that balances exploration and exploitation, effectively solving the parameter combination space explosion problem in traditional configuration fuzzing methods, ensuring efficient energy scheduling and resource allocation during fuzzing. Finally, it leverages existing oracle mechanisms to verify the execution results of SQL statements, while simultaneously uncovering logical and crash vulnerabilities. This invention's parameter-sensitive database fuzzing method based on combinatorial testing effectively addresses the shortcomings of existing fuzzing tools in testing database parameters, fully explores the vast database parameter combination space, ensures high parameter relevance and high semantic and syntactic accuracy of test samples, and improves the comprehensiveness and accuracy of database fuzzing.

[0087] It should be noted that the above content merely illustrates the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. For those skilled in the art, various improvements and modifications can be made without departing from the principle of the present invention, and all such improvements and modifications fall within the scope of protection of the claims of the present invention.

Claims

1. A fuzz testing method for parameter-sensitive databases based on combined testing, characterized in that... The steps include the following: S1: Obtain the set of basic code blocks covering each parameter through static taint analysis, generate the initial weight value of each parameter, construct a binary parameter weight matrix, and select the binary parameter combination with the highest total weight as the high-priority test combination; S2: Calculate mutual information and novelty scores through coverage feedback, determine the weight of each SQL feature under the given parameter, evaluate the importance of the feature under the specific parameter, and construct a test case generation scheme corresponding to the parameter. S3: Based on the weights generated in steps S1 and S2, generate parameters and corresponding test cases, and use them... The -greedy strategy dynamically balances the exploration and utilization phases of fuzz testing and verifies the test case execution results through an oracle.

2. The fuzz testing method for parameter-sensitive databases based on combined testing as described in claim 1, characterized in that: In step S1, the initial weight value is calculated based on the number of basic blocks covered by each parameter, and a 2-wise combination test strategy is adopted. A binary parameter weight matrix is ​​constructed in the combination space, where N is the total number of database parameters; the binary parameter weight matrix includes the sum of the basic weights of each parameter and the synergistic effect weight of the joint execution of the two parameters.

3. The fuzzy testing method for parameter-sensitive databases based on combined testing as described in claim 2, characterized in that: In step S1, the sum of the basic weights of each parameter Specifically: ； in, Parameters , The initial weight values; The synergistic effect weights of the two parameters being jointly executed Specifically: ； in, , Parameters , A collection of basic code blocks that are covered.

4. The parameter-sensitive database fuzzing method based on combined testing as described in claim 1, characterized in that: In step S2, mutual information is used to quantify the statistical dependency between SQL features and program execution edges, specifically: ; in, For parameters next,characteristics and edge The probability of them occurring simultaneously For parameters next,characteristics The probability of occurrence For parameters below The probability of being covered; The novelty score is calculated as follows: ; in, For parameters below The number of times it was covered; The specific method for calculating the weight values ​​of each SQL feature is as follows: 。 5. The fuzz testing method for parameter-sensitive databases based on combined testing as described in claim 4, characterized in that: In step S2, the weight value of each SQL feature is normalized to obtain the final condition generation probability of each SQL feature class under specific parameters. The weights of all SQL features are converted into a probability distribution to ensure that the generated test cases conform to the probability distribution law. Specifically: ; in, For parameters SQL features The weight value, This represents the total number of SQL features.

6. The fuzz testing method for parameter-sensitive databases based on combined testing as described in claim 1, characterized in that: In step S3 The specific dynamic selection method of the -greedy strategy is as follows: during initial testing, a high probability is used... Explore unknown parameter combinations and dynamically decrease them as the test time increases. The size of the value gradually increases the probability of utilizing existing priority parameter combinations; the dynamic decay of the exploration rate is specifically as follows: ; in, This is the initial exploration rate; Minimum exploration rate; This is the decay time constant.

7. The method for fuzz testing parameter-sensitive databases based on combined testing as described in claim 1, characterized in that: The oracle mechanism in step S3 includes a differential oracle and a metamorphic oracle. The differential oracle compares the execution results of the same test sample by different database management systems. The metamorphic oracle generates an equivalent variant query and compares whether the execution results of the original query and the variant query are consistent.

8. A parameter-sensitive database fuzz testing system based on combinatorial testing, comprising a computer program, characterized in that: When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1-7 above.

Images