Value semantics-aware metamorphic testing method and system for detecting logical defects of DBMS

Abstract

This invention discloses a value semantic-aware metamorphic testing method and system for detecting logical defects in DBMS, belonging to the field of database management technology. The method includes the following steps: designing a basic syntax for the DBMS under test to construct an original query; partially rewriting the original query to generate a mutated query, wherein the original query and the mutated query satisfy an approximation relationship; parsing the original query and the mutated query into an abstract syntax tree (AST) and finding the propagation link of the partial rewrite on the AST to generate a query-level approximation relationship between the original query and the mutated query; executing the original query and the mutated query on the DBMS under test, collecting the execution results and comparing them with the query-level approximation relationship to determine whether there is a logical defect. This invention proposes a unified SQL query approximation model that integrates set semantics and value semantic reasoning, detecting logical errors in database management systems by mutating SQL queries and propagating semantic approximations.

Description

Technical Field

[0001] This invention relates to the field of database management technology, and in particular to a value semantic awareness degradation test method and system for detecting logical defects in DBMS. Background Technology

[0002] Database Management Systems (DBMS) contain complex code logic and extensive functional modules, making them prone to vulnerabilities. Logical vulnerabilities are particularly critical, as they can lead to incorrect output of query results within the DBMS. To detect logical vulnerabilities, existing methods test the DBMS by generating SQL queries and verifying whether the results meet expectations. A core technical challenge in this process lies in defining the correct result criteria for a specific query—a classic problem in software testing known as the oracle problem. Several solutions have been proposed for the oracle problem, including difference testing, oracle-guided synthesis, and metamorphic testing (MT). Difference testing cannot uncover vulnerabilities existing only in a single DBMS implementation and is often inapplicable when queries contain specific dialectal features. Similarly, oracle-guided synthesis has limited coverage due to its inference of only a single master row at a time, easily overlooking numerous logical vulnerabilities. These limitations have led to the widespread adoption of metamorphic testing (MT), which successfully overcomes the oracle problem by establishing a systematic transformation of the expected semantic relationships between query pairs.

[0003] While metamorphic testing (MT) has become the most effective paradigm for detecting logical errors in database management systems (DBMS), existing MT methods still struggle to capture many subtle semantic inconsistencies. Current MT methods can be broadly categorized into two types: those based on equivalence metamorphic relations and those based on approximate metamorphic relations. The first type, represented by NOREC and TLP, defines equivalence relations as strict output equivalence between the original query and the transformed query. NOREC transforms an optimizable query into a non-optimizable form to verify whether the two forms produce the same result, while TLP splits the query predicate into multiple subqueries whose combined output is expected to equal the original result. While these equivalence-based frameworks have proven effective in detecting optimizer and predicate correlation inconsistencies, they are still insufficient to reveal many deeply hidden errors. This limitation stems from the fact that, within a constrained mutation space, equivalence query pairs often still share the same erroneous operators or functions, ultimately producing the same but incorrect results. Therefore, such methods are limited to surface-level correctness and cannot uncover deep semantic defects that violate relational semantics while maintaining structural equivalence. The second type, exemplified by PINOLO, generalizes this paradigm through set semantic approximation. Unlike requiring exact equivalence, PINOLO generates super-approximate and under-approximate variants by relaxing query conditions and checking whether the generated sets satisfy inclusion relations. This relaxation significantly expands the detectable error space, enabling the discovery of subtle semantic inconsistencies that are often overlooked by equivalence-based methods. However, set semantic approximation focuses on the inclusion relations between resulting tuples, not how tuple values ​​are computed. Operations such as aggregation or arithmetic compress (multi) sets of input values ​​into scalar results, the correctness of which depends on numerical computation rather than tuple membership relations. When the underlying set of tuples remains unchanged, the output still satisfies the same set relations even if such value-level computations are violated. Therefore, inconsistencies arising from value semantics are beyond the scope of set semantic approximation and are beyond PINOLO's detection capabilities. Summary of the Invention

[0004] The purpose of this invention is to solve the problems in the prior art.

[0005] The technical solution adopted by this invention to solve its technical problem is: to provide a value semantic awareness metamorphosis test method for detecting logical defects in DBMS, including the following steps:

[0006] The original query construction steps involve designing basic syntax for the DBMS under test to construct the original query.

[0007] The mutation query generation process involves partially rewriting the original query to generate a mutation query, and the original query and the mutation query satisfy an approximation relationship.

[0008] The approximate propagation step parses the original query and the mutated query into an abstract syntax tree (AST) and finds the propagation link of the local rewrite on the AST to generate a query-level approximate relationship between the original query and the mutated query.

[0009] The logical defect detection step involves executing the original query and the variant query on the DBMS under test, collecting the execution results and comparing them with the query-level approximation relationship to determine whether there is a logical defect.

[0010] The approximation relations include set-level approximation and value-level approximation, defined as follows:

[0011] For set-level approximation, let q1 and q2 be two SQL queries, which, after execution on database D, yield result sets R(q1, D) and R(q2, D) respectively; a result set is obtained if and only if R(q1, D) is satisfied. When R(q2, D), q1 is called a set-level underapproximation of q2 on D, denoted as q1 q2; if and only if R(q1, D) R(q2, D) is called a set-level hyperapproximation of q2 on D, denoted as q1. q2;

[0012] For value approximation, let q1 and q2 be two SQL queries, which, after execution on database D, yield result sets R(q1, D) and R(q2, D) respectively; let Ct Cols(R(q1,D))∩Cols(R(q2,D)) represents the target column set for comparison, and Cols represents the selection column set. q1 is called a value-level super-approximation of q2 on D if and only if for all g∈G*, c∈Ct, Vq1(g,c)≥Vq2(g,c), denoted as q1. q2; otherwise, q1 is called an under-approximation of the order of q2, denoted as q1. q2; where G* represents the set of all comparable tuple groups under G, and G represents the grouping or sorting basis, which is determined as follows: if the query contains a GROUP BY clause, then G corresponds to the grouping key; otherwise, G indicates that non-target columns are deterministically sorted to align tuples for comparison; Vq(g, c) represents the column c value generated by query q in group g.

[0013] Preferably, the basic syntax for designing the DBMS under test to construct the original query adopts a syntax parsing model of the Structured Query Language (SQL), defines a complete set of syntax rules supported by the database query tool, and is logically constructed using Backus Normal Form (BNF) or its variants, specifically including the following technical levels:

[0014] Statement and Query Core Layer: Top-level statement structure, defining the statement sequence with Q as the core, supporting concurrency lock control via FORLM, and using WITH clause to implement recursive or non-recursive definition of common table expressions; Query core component, guided by the SELECT keyword, supports DISTINCT deduplication option, SL target column selection, FC data source reference, and optional integrated filtering, GB grouping aggregation, OB sorting and L pagination limit;

[0015] Relational and set operation layer: multi-table association mechanism, supporting multiple join types, including inner join, left outer join, right outer join and cross join, and defining association Boolean expressions through ON BE.

[0016] Preferably, the step of partially rewriting the original query to generate a mutated query is implemented using an approximate mutator;

[0017] The approximate mutant is an operator that defines the applicable AST node types, the changes performed on the nodes, the direction of the changes, and the semantic level.

[0018] The direction of change includes under-approximation and over-approximation; the semantic level includes set level and value level;

[0019] Changes performed on nodes include set semantic mutations and value semantic mutations; set semantic mutations adjust the scope and composition of the result set by changing relational operations, predicate logic, and join types; value semantic mutations interfere with the final output value by changing computation formulas and statistical dimensions.

[0020] Preferably, the approximate mutant includes the following four types:

[0021] Relational mutants are used to change how datasets are combined or excluded.

[0022] Predicate mutants are used to modify query conditions;

[0023] Aggregation mutants are used to change aggregation behavior;

[0024] Expression mutators are used to modify arithmetic or logical expressions.

[0025] Preferably, the step of parsing the original query and the modified query into an Abstract Syntax Tree (AST) and finding the propagation path of the local rewrite on the AST to generate a query-level approximation relationship between the original query and the modified query includes the following steps:

[0026] The AST parsing steps parse the original query and the mutated query into an abstract syntax tree (AST), identify the modified nodes in the mutated query, and construct an ancestor chain from the modified nodes to the query root node.

[0027] The initialization steps include the initialization of the semantic level and the change direction; if the mutated node involves a predicate or subquery, the semantic level is initialized to the set level; if the mutated node involves an expression or aggregation operation, the semantic level is initialized to the value level; the direction sign is initialized to +1; a direction sign of +1 indicates that the change direction is super approximation, and a direction sign of -1 indicates that the change direction is under-approximation.

[0028] The propagation step iterates through each node in the ancestor chain from bottom to top, checking whether each node is semantically dependent on its modified child node. If so, the propagation operation is performed until the root node is reached, generating the final query-level approximation relationship between the original query and the modified query; and returning a set-level or numerical semantic approximation based on the semantic level of the root node and the propagation direction.

[0029] The propagation operation includes updating the node based on the semantic mapping corresponding to the node's operator and its monotonic direction.

[0030] Preferably, the step of checking whether each node semantically depends on its modified child nodes, and only propagating to dependent nodes, specifically involves:

[0031] If the child node level is value level, then when the column or alias of the child node appears in the parent node expression, it will be propagated.

[0032] If the child node level is set level, then when the parent node references the child node in a subquery or table-based manner, the reference is propagated.

[0033] Otherwise, it will not be disseminated.

[0034] Preferably, the update based on the semantic mapping corresponding to the operator of the node and its monotonic direction includes the following steps:

[0035] The semantic mapping and monotonic direction of the operator are found in the predefined operator monotonicity table;

[0036] The semantic level is updated based on the semantic mapping, represented as α←α_out, where α represents the current semantic level, ← represents assignment, and α_out represents the output level of the corresponding semantic mapping;

[0037] The direction sign is updated by multiplying by the monotonic direction, denoted as sign ← sign • σ(o pi), where sign represents the current direction sign and σ(o pi) represents the corresponding monotonic direction.

[0038] Preferably, the collection of execution results is compared with the query-level approximation relationship to determine whether there are logical defects, including two cases;

[0039] If the original query and the mutated query have similar set semantics, check whether the execution result set of the mutated query is a subset or superset of the execution result set of the original query; if so, there is no logical defect; otherwise, there is a logical defect.

[0040] For cases where the original query and the mutated query have similar value semantics, compare the values ​​in the target columns of the two queries to ensure that they satisfy the expected monotonic relationship, including increasing or decreasing; if so, there is no logical defect; otherwise, there is a logical defect.

[0041] This invention also provides a value semantic-aware metamorphosis testing system for detecting logical defects in DBMS, comprising:

[0042] The raw query building module designs the basic syntax for the DBMS under test to build raw queries;

[0043] The mutation query generation module partially rewrites the original query to generate a mutation query, and the original query and the mutation query satisfy an approximate relationship.

[0044] The approximation propagation module parses the original query and the modified query into an abstract syntax tree (AST) and finds the propagation link of the local rewrite on the AST, generating a query-level approximation relationship between the original query and the modified query.

[0045] The logic defect detection module executes original queries and variant queries on the DBMS under test, collects the execution results and compares them with the query-level approximation relationship to determine whether there are any logic defects.

[0046] The approximation relations include set-level approximation and value-level approximation, defined as follows:

[0047] For set-level approximation, let q1 and q2 be two SQL queries, which, after execution on database D, yield result sets R(q1, D) and R(q2, D) respectively; a result set is obtained if and only if R(q1, D) is satisfied. When R(q2, D), q1 is called a set-level underapproximation of q2 on D, denoted as q1 q2; if and only if R(q1, D) R(q2, D) is called a set-level hyperapproximation of q2 on D, denoted as q1. q2;

[0048] For value approximation, let q1 and q2 be two SQL queries, which, after execution on database D, yield result sets R(q1, D) and R(q2, D) respectively; let Ct Cols(R(q1,D))∩Cols(R(q2,D)) represents the set of target columns for comparison; G represents the grouping or sorting criterion, which is determined as follows: if the query contains a GROUP BY clause, then G corresponds to the grouping key; otherwise, G represents a deterministic sorting of non-target columns (such as primary keys or lexicographical order of attributes) to align tuples for comparison; q1 is called a value-level super-approximation of q2 on D if and only if for all g∈G*, c∈Ct, Vq1(g,c)≥Vq2(g,c), denoted as q1 q2; otherwise, q1 is called an under-approximation of the order of q2, denoted as q1. q2; where G* represents the set of all comparable tuples under G, and Vq(g, c) represents the column c value generated by query q in group g.

[0049] The present invention has the following beneficial effects: The present invention proposes a unified SQL query approximation model that integrates set semantics and value semantics reasoning. Based on this model, a variant testing framework is developed to reveal deep logical contradictions by mutating SQL queries and propagating semantic approximations, which is used to detect logical errors in database management systems.

[0050] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments, but the present invention is not limited to the embodiments. Attached Figure Description

[0051] Figure 1 This is a flowchart illustrating the steps of a value semantic awareness metamorphosis test method for detecting logical defects in DBMS, according to an embodiment of the present invention.

[0052] Figure 2 This is a flowchart illustrating a value semantic awareness metamorphosis testing method for detecting logical defects in DBMS, according to an embodiment of the present invention.

[0053] Figure 3 This is a schematic diagram illustrating the approximate propagation of a value semantic-aware metamorphosis testing method for detecting logical defects in DBMS, according to an embodiment of the present invention.

[0054] Figure 4 This is a schematic diagram of the structure of a value semantic awareness metamorphosis test system for detecting logical defects in DBMS, according to an embodiment of the present invention. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0056] See Figure 1 and Figure 2 As shown in the figure, an embodiment of the present invention provides a value semantic awareness metamorphosis testing method for detecting logical defects in DBMS, comprising the following steps:

[0057] S101, Original query construction steps: Design the basic syntax for the DBMS under test to construct the original query;

[0058] S102, the mutation query generation step, involves partially rewriting the original query to generate a mutation query, and the original query and the mutation query satisfy an approximate relationship;

[0059] S103, Approximate propagation step: Parse the original query and the modified query into an abstract syntax tree (AST) and find the propagation link of the local rewrite on the AST to generate a query-level approximation relationship between the original query and the modified query.

[0060] S104, Logical defect detection step: Execute the original query and the variant query on the DBMS under test, collect the execution results and compare them with the query-level approximation relationship to determine whether there is a logical defect.

[0061] Specifically, this invention proposes the core concept of SQL query approximation, integrating two complementary dimensions of query behavior analysis: set semantic dimension and value semantic dimension. The set semantic dimension characterizes the differences in the returned tuple sets, while the value semantic dimension captures the monotonic variation patterns of these tuples in their calculated or aggregated values. By combining these two dimensions, a unified semantic consistency expression and reasoning framework is constructed, enabling the development of more expressive test oracles and effectively detecting semantic inconsistencies in database management systems at both the set and value levels.

[0062] First, define a semantic approximation relation for sets. Given a database D, let q1 and q2 be two SQL queries with result sets R(q1, D) and R(q2, D), respectively. A query is valid if and only if R(q1, D) is satisfied. When R(q2, D), q1 is called a set-level underapproximation of q2 on D, denoted as q1 q2. Conversely, if and only if R(q1, D). If R(q2, D), then q1 is a set-level hyperapproximation of q2 on D, denoted as q1. q2. Where R(q, D) represents the multiset returned when query q is executed on database D. and This represents the inclusion relationship between two multisets. Intuitively, set semantics approximates a partial order relationship between queries: q1 q2 indicates that the result produced by q1 is narrower or more restrictive than q2, while q1 q2 indicates that the result of q1 is more general or less restrictive. These two relations are inverses of each other and together define the lattice structure of set-level approximations.

[0063] For example, consider a database D = {t1}, where t1(c1) = {-1, 0, 1}. Now consider the following query:

[0064] q1: SELECT c1 FROM t1 WHERE c1 ≤ 0;

[0065] q2: SELECT c1 FROM t1 WHERE TRUE;

[0066] The corresponding query results are:

[0067] R(q1,D)={-1,0}, R(q2,D)={-1,0,1};

[0068] Obviously,

[0069] R(q1,D) R(q2,D);

[0070] This establishes the semantic approximation relation of sets: q1 q2

[0071] Intuitively, q1 is a restricted version of q2. Relaxing the choice predicate expands the result set and induces inclusion relationships between their outputs.

[0072] Secondly, value semantic approximation is defined. To overcome the limitations of simple set-level containment relations, the approximation relation is extended from the set level to the value level. Unlike set-level relations that focus on tuple containment, value semantic relations capture the monotonic changes in the target columns—the values ​​of these columns depend on value-level computational semantics (such as aggregation, arithmetic operations, or other scalar transformations), rather than tuple membership relations. This allows the framework to detect logical errors: when queries return the same tuples but have different value semantics.

[0073] Given a database D, let q1 and q2 be two SQL queries with result sets R(q1, D) and R(q2, D) respectively. Let Ct Cols(R(q1,D))∩Cols(R(q2,D)) represents the set of target columns for comparison. G represents the grouping or sorting criterion, determined as follows: if the query contains a GROUP BY clause, G corresponds to the grouping key. Otherwise, G represents a deterministic sorting of non-target columns (such as primary keys or lexicographical order of attributes) to align tuples for comparison. q1 is called a value-level super-approximation of q2 on D if and only if for all g∈G*, c∈Ct, Vq1(g,c)≥Vq2(g,c). q2. Where G* represents the set of all comparable tuples under G, and Vq(g, c) represents the column c value (or tuple position) generated by query q in group g. Conversely, q1 is a value-level underestimation of q2, denoted as q1. q2. This definition unifies two scenarios: intra-group comparisons in aggregate queries and sequential comparisons of non-aggregate results. The interpretation of the comparison operators ≥ and ≤ follows standard SQL semantics, based on the total order relation defined by the SQL data type of column c.

[0074] Intuitively, set semantics are similar ( ) describes the inclusion relationship of tuples, while the value semantics approximate ( This reflects the monotonicity between the corresponding tuple values.

[0075] For example, consider t1(c1, c2), which is represented as:

[0076] ;

[0077] Define the following two queries:

[0078] q1: SELECT c2, MAX(c1) FROM t1 GROUP BY c2;

[0079] q2: SELECT c2, MIN(c1) FROM t1 GROUP BY c2;

[0080] turn out:

[0081] ;

[0082] Given the grouping reference G={c2} and the target column Ct={c1}, for each g∈G*={A, B}:

[0083] Vq1(g,c1)≥Vq2(g,c1);

[0084] Therefore, q1 q2. Intuitively, the two queries return the same set of groups (i.e., q1 ≡ s D q2), but their value semantics have a monotonic difference: the aggregate value of q1 in each group is not less than q2.

[0085] However, in actual database management system testing, a mutation typically affects only a local part of the query—such as predicates, operators, or aggregate functions—rather than the entire query. To describe and reason about this fine-grained change, the concept of an approximate mutant is defined, which acts as the smallest structural unit that induces local approximations in a query. Let q denote an SQL query represented by an Abstract Syntax Tree (AST), and n ∈ q be a node in that tree. The approximate mutant µ is an operator that transforms n into a semantically related variant n' such that two nodes satisfy the approximation relation n'. n' or n n', where α∈ {s, v} represents the set semantics or value semantics level.

[0086] Each mutant µ has the following characteristics:

[0087] Scope: The types of AST nodes to which it applies, such as predicates, arithmetic expressions, aggregate functions, or subqueries;

[0088] Transformation rules: Syntactic or semantic changes performed on nodes (e.g., <→<=, MAX→MIN, adding conjunction conditions);

[0089] Approximation type: The approximation type induced by mutation is determined by both the direction of the change and the semantic level. The direction can be under-approximation or over-approximation, while the semantic level can be set semantic approximation or value semantic approximation.

[0090] The application of the mutant is represented as n' = µ(n), and the resulting local approximation is represented as n n' (or its inverse relation). Approximate variants represent atomic semantic deviations in a query that can be passed to its parent operator and affect the overall query result.

[0091] To understand how such local variations affect the final query output, the discussion extends from the semantic level of full query comparison to the structural level of SQL. Specifically, the concept of approximation propagation is defined, describing how local approximation relations established on a node of a query's abstract syntax tree (AST) can be propagated through its parent operators and clauses, thus determining how a single mutation affects the overall approximation behavior of the query. Let D be a database, and n1 and n2 represent two semantically comparable nodes (e.g., subqueries, predicates, or expressions) in the SQL AST. These nodes may directly correspond to mutation sites introduced by approximate variants (for some variant µ, n2 = µ(n1)), or they may represent ancestor nodes whose semantics are indirectly affected by the propagation of such local variations. We use the uniform notation n1. Let n2 represent the approximation relation of type α∈{s, v}, where s and v correspond to the set semantics and value semantics levels, respectively. Compared to query-level approximation, approximation propagation extends these relations to the structural level, capturing how local approximations between Abstract Syntax Tree (AST) nodes affect or induce higher-level approximations in queries.

[0092] At higher levels of the query, operators (such as aggregate functions or filtering conditions) are applied to nodes and influence the approximate behavior of the entire query. Formally, each operator `op` is represented by two semantic attributes. First, the mapping (α) in → α out The operator `op` defines how to transform the approximation level between the set dimension (α = s) and the value dimension (α = v). Secondly, the direction indicator `σ(op) ∈ {+1, -1}` specifies whether `op` preserves or reverses the approximation order. Specifically, `σ(op) = +1` indicates that the operator preserves the order, i.e., it maintains the direction of the approximation; while `σ(op) = -1` indicates that the operator reverses the order, i.e., it reverses the direction of the approximation.

[0093] Based on these two attributes, the local relation n1 n2 can be organized into four standard forms through the propagation of the operator op:

[0094] (Set → Set): Suppose two nodes n1 and n2 satisfy set semantics approximation n1 n2. When two nodes are uniformly embedded under the set-level operator ops, the generated parent nodes ops(n1) and ops(n2) satisfy:

[0095] ;

[0096] Here, σ(ops) = +1 for monotonic set operators that preserve tuple inclusion relationships, such as EXISTS; and σ(ops) = -1, which is applicable to negation conditions such as NOT or NOT EXISTS, used to determine whether a tuple contains another tuple.

[0097] (Set → Value): Given n1 Let f be an aggregation or set-to-value mapping operator. Applying f to two nodes induces a semantic approximation of the value:

[0098] ;

[0099] Here, σ(f) = +1 is for aggregate functions whose output monotonically increases with the input set (e.g., MAX, SUM, COUNT), while σ(f) = -1 is for inverse functions (e.g., MIN).

[0100] (Value → Value): Suppose two values ​​generate nodes satisfying n1 n2. For the scalar operator opv applied to two nodes, the result value satisfies:

[0101] ;

[0102] Here, if opv maintains the order of the semantic approximation of the value (e.g., x + c, where c ≥ 0), then σ(opv) = +1; if opv is reversed (e.g., negation), then σ(opv) = -1.

[0103] (Value → Set): Suppose two value expressions satisfy n1 n2. If both expressions are consumed by the predicate or filter operator ops, the induced result set satisfies:

[0104] ;

[0105] Here, σ(ops) = +1 for monotonically increasing predicates (e.g., x > c, where larger x values ​​make the condition more likely to be true, thus expanding the result set), while σ(ops) = -1 for monotonically decreasing predicates (e.g., x < c, where larger x values ​​make the condition less likely to be true, resulting in a smaller result set).

[0106] In this definition, n1 and n2 are not limited to the complete query. They can represent a single query or corresponding subqueries, expressions, or predicates in two query variations. Therefore, the relation... It captures how local semantic approximations propagate based on the monotonic behavior of SQL operators, unifying value-level and set-level semantics within a single framework.

[0107] Intuitively, this propagation mechanism provides a semantic bridge between tuple-level inclusion and value-level monotonicity. Set-level approximation can trigger changes in values ​​through monotonic operators, while value-level changes, in turn, can alter the query result set when the affected values ​​participate in predicates. This bidirectional propagation enables comprehensive reasoning about multi-level SQL dependencies.

[0108] For example, the (set → value propagation) form. Consider two queries on table t1(c1, c2):

[0109] q1 : SELECT MAX(c1) FROM t1 WHERE c2 < 100;

[0110] q2 : SELECT MAX(c1) FROM t1 WHERE c2 < 200;

[0111] In the query structure, let n1 and n2 represent the WHERE clause nodes of queries q1 and q2, respectively. The condition c2 < 100 in n1 is more stringent than c2 < 200 in n2; therefore, the rows filtered by n1 are a subset of the results filtered by n2. The parent node of these filtering conditions is the aggregation operator MAX, which has a monotonically increasing property: as more rows are included, the maximum value of c1 can only increase or remain unchanged. Therefore, differences at the set level (increase or decrease in the number of tuples) propagate upwards to differences at the value level (increase or decrease in aggregate values).

[0112] Intuitively, n1 and n2 demonstrate how local changes in set-level filtering conditions affect the aggregation result value, reflecting the transfer mechanism from set to value.

[0113] For example, in the form of (value → set propagation), consider performing two semantically related queries on table t1(c1):

[0114] q1 : SELECT∗ FROM (SELECT MAX(c1) AS x FROM t1) AS subq WHERE x >100;

[0115] q2 : SELECT∗ FROM (SELECT MIN(c1) AS x FROM t1) AS subq WHERE x >100;

[0116] The two queries differ only in their internal aggregations. Let n1 and n2 represent the aggregation nodes MAX(c_1) and MIN(c_2), respectively. Changing MAX to MIN reduces the derived value x. Since the outer predicate x > 100 monotonically increases with x, smaller x values ​​make the condition harder to satisfy, resulting in fewer output tuples. Therefore, the result of q2 becomes a subset of q1, demonstrating typical value-to-set propagation.

[0117] These propagation behaviors connect two approximate dimensions, enabling any single mutation of an AST node (e.g., MAX→MIN) to have a predictable and analyzable impact on the result structure and result values. This unified propagation model forms the semantic foundation of our testing framework.

[0118] To support diverse SQL structures in testing, raw queries are constructed based on a concise and expressive SQL syntax that defines a complete set of syntax rules supported by database query tools. The model is logically constructed using Backus Normal Form (BNF) or its variants, specifically encompassing the following technical layers:

[0119] (1) Statement & Query Core

[0120] Top-level statement structure: Defines a statement sequence centered around Q (Query), supports concurrent lock control via FOR LM (LockMode) (such as UPDATE, SHARE, etc.), and utilizes WITH clauses to implement recursive or non-recursive definitions of Common Table Expressions (CTEs).

[0121] The core query component is guided by the SELECT keyword and supports the DISTINCT deduplication option, SL (SelectList) target column selection, FC (FromClause) data source reference, and can optionally integrate WH (Where) filtering, GB (GroupBy) grouping aggregation, OB (OrderBy) sorting, and L (Limit) pagination limit.

[0122] (2) Relational & Set Operations

[0123] Multi-table join mechanism: Supports multiple join types, including inner join, left / right outer join and cross join, and defines the join Boolean expression through ON BE.

[0124] The details are as follows:

[0125]

[0126] This syntax extends the basic syntax used in PINOLO, enabling the generation of more diverse queries by introducing a richer set of syntactic components. Compared to PINOLO, which primarily focuses on the basic select-FROM-where statement, the syntax of this embodiment supports a wider range of SQL features, including comprehensive JOIN types and conditions, common table expressions (CTEs) based on WITH clauses, and row-level locking modes such as FOR update. The syntax of this embodiment also introduces extended features such as group BY and order BY clauses with filtering conditions, and nested function calls with type conversions and CASE expressions. These extensions collectively enable the generation of queries with syntactic and semantic richness that more accurately reflects the workloads of real-world database management systems. The syntax of this embodiment supports compact SQL syntax, and its key difference from PINOLO lies in the handling of aggregate-related query structures. PINOLO is built on set-level approximations of tuple-level query results, which fundamentally limits its applicability to queries that maintain monotonic inclusion in their output. Therefore, queries involving aggregation—such as those containing GROUP BY or HAVING clauses—are not supported because aggregation compresses the set of tuples into a computed value, violating the set-level monotonicity assumed by its model. In contrast, the syntax of this embodiment introduces value semantic approximations, which can explicitly capture changes in aggregation and computed values ​​under local semantic perturbations, thereby enabling systematic testing of queries with aggregation and grouping.

[0127] Specifically, this invention designs a set of approximate mutants to introduce controllable semantic biases into SQL queries. Each mutant corresponds to a local modification applied to a specific node in the query AST. The design goal is to cover both the set and numerical levels of SQL semantics, thereby enabling the detection of various logical errors in the database management system. Table 1 lists some representative mutants, where transforming C1 into C2 achieves a super-approximation; its reverse transformation results in a under-approximation.

[0128] Table 1 - Representative approximate mutants:

[0129]

[0130] The mutation operator set involved in this invention mainly consists of two parts: set semantic mutation operators and value semantic mutation operators, which are used to perform logical offsets and numerical fine-tuning on the original database query statements.

[0131] First, at the level of semantic variation in sets, this solution adjusts the scope and composition of the result set by changing relational operations, predicate logic, and join types. Specifically, this includes:

[0132] Relational operation variations: replace the deduplicated union with the union that includes duplicate values, or replace the intersection with the union, and simplify the difference to the original one-sided set;

[0133] Predicate and join variation: weaken specific filter conditions (WHERE cond) to tautological conditions (WHERE TRUE), or scale the wildcard precision of fuzzy matching (LIKE); at the same time, support expanding comparison operators from strict constraints (such as "<") to non-strict constraints (such as "<="), and convert inner joins (INNER JOIN) to left outer joins (LEFT JOIN) to verify the system's response to the tolerance of data association.

[0134] Secondly, at the level of value semantic variation, this scheme focuses on interfering with the final output value by changing the calculation formula and statistical dimensions. Specifically, this includes:

[0135] Aggregate function variation: On the statistical dimension, it realizes the conversion from deduplication count (COUNT DISTINCT) to full count, as well as the logical interchange between statistical indicators such as mean (AVG), maximum (MAX), sample standard deviation (STDDEV_SAMP) and sample variance (VAR_SAMP);

[0136] Numerical variation of expression: through the modification of the original expression.

[0137] Approximate mutants include the following four types:

[0138] Relational mutants are those that alter how a dataset is combined or excluded. For example, replacing UNION with UNION ALL allows duplicates, while replacing INTERSECT with UNION changes the set inclusion behavior. These mutations affect the coverage of the result set.

[0139] Predicate mutants modify query conditions. For example, setting the WHERE condition to TRUE will include all rows, while setting it to FALSE will exclude all rows. Modifying comparison operators (such as < to <=) will expand the range of results.

[0140] Aggregation mutants are those that alter aggregation behavior. For example, changing COUNT(DISTINCT c) to COUNT(c) will affect how duplicates are handled, while replacing AVG(c) with MAX(c) will change the nature of the result.

[0141] Expression mutants modify arithmetic or logical expressions, such as by adding or multiplying by constants. These changes affect the calculated values ​​and the final query output. Specifically, super approximation propagation determines how local semantic changes propagate through the SQL abstract syntax tree. Its main purpose is to formalize the top-down reasoning process into a systematic bottom-up propagation flow, connecting local node mutations with their global semantic consequences at the query level. The specific algorithm is shown below:

[0142]

[0143] The algorithm demonstrates the overall propagation process.

[0144] Initially (lines 1–3), the algorithm receives the mutated node information node_info and the complete AST of the query, and identifies the mutated node n. mut And construct its ancestor chain from the mutation position to the query root node, represented as list = [n mut ,...,n root ].

[0145] The algorithm initializes the local semantic hierarchy of mutations (lines 5–7): if the mutation node involves a predicate or subquery, it starts from the set level (α(n mut ) = s); otherwise, for expressions or aggregation operations, start from the value hierarchy (α(n)). mut =v). The direction accumulator sign was also initialized to +1 to indicate that the propagation initially maintained directionality.

[0146] During the propagation phase (lines 9–17), the algorithm iterates through n in a bottom-up manner. mut For each parent node, perform the following operations: Check if the parent node semantically depends on the modified child node—only dependent nodes are considered for propagation by referencing its output columns (for value-level nodes) or embedding it as a subquery or relation; for each parent operator o pi (line 9), retrieve the corresponding semantic mapping (α). in → α out The semantic layer α is updated according to the input-output mapping of the operators (e.g., Set→Value for aggregation operations, or Value→Set for predicate filtering), while the cumulative direction sign is updated by multiplication (sign ←sign · σ(o pi)), maintaining or reversing the relationship according to the polarity of the operators (lines 14–16). This recursive process effectively tracks the semantic transformation path from the point of change to the query output.

[0147] At the root node (lines 19–25), the algorithm generates a final query-level approximation between the original query and the modified query, and returns a set-level or numerical approximation based on the semantic level of the root node and the direction of cumulative propagation.

[0148] For a detailed flowchart of the specific algorithm execution, please refer to [link / reference]. Figure 3 The mutation (i.e., rewriting) occurs at the aggregation node, where MAX(c1) is replaced by MIN(c1), initializing a value hierarchy relation (α = v) with its monotonicity reversed (σ = -1). The algorithm then traverses its ancestor list = [n MAX ,n subq ,n WHERE ,n COUNT This paper evaluates how this local change propagates upwards through the query structure. When the propagation reaches the subquery node (SELECT ... AS x), the semantics are elevated from the value level to the set level (α: v→s, σ=+1). According to Table 2, the subquery appearing in the FROM clause serves as the data source, preserving the tuple containment relation—expanding the underlying relation to produce a superset of tuples, thus maintaining positive monotonicity. The subsequent WHERE > 100 clause applies a filtering operator that maintains the set level but reverses the direction (α: s→s, σ=-1). Finally, the COUNT(*) operator aggregates the result set back to the value level (α: s→v, σ=+1). Therefore, the cumulative symbol is (-1) × (+1) × (-1) × (+1) = +1, yielding a final value level approximation q1. q2, which indicates that the output of q1 constitutes a value order under-approximation of q2, where q1 and q2 are expressed as:

[0149] q1: SELECT COUNT(*) FROM (SELECT MAX(c1) AS x FROM t1) WHERE x > 100;

[0150] q2: SELECT COUNT(*) FROM (SELECT MIN(c1) AS x FROM t1) WHERE x > 100;

[0151] Table 2 - Operator Types and Semantic Propagation Rules:

[0152]

[0153] The primary purpose of the result check is to verify whether the outputs of the original SQL query and the mutated SQL query are consistent with the predicted approximation relation defined in the previous section. Unlike traditional methods that rely on strict equivalence or set inclusion checks, which often overlook subtle semantic differences, the method in this embodiment of the invention considers both set semantics and value semantics approximation relations, thus enabling the detection of broader logical inconsistencies in database management system query results. After executing the two queries, their results are compared according to the expected approximation relation (set or value). Specifically: for set semantic approximation, it checks whether the result set of the mutated query is a subset or superset of the result set of the original query, as predicted by the approximation relation; for value semantic approximation, it compares the values ​​in the target columns of the two queries to ensure they satisfy the expected monotonic relation (increasing or decreasing). Violation of this relation indicates a logical inconsistency in the database management system query processing.

[0154] The method of this invention is implemented as a database management system test system, VALSCOPE, written in Python, with a total of 13,455 lines of code. Key implementation details are described below.

[0155] (1) Database Instance Generation. A random database instance is generated from scratch using the PINOLO method, covering most data types specified in the SQL documentation. Unlike existing random database instance generation methods, VALSCOPE also considers type-specific behavior and boundary cases. For each column, a value is generated based on the constraints of the corresponding data type to ensure validity. This helps prevent common runtime errors, such as INSERT failures due to out-of-range or malformed formats. To increase the likelihood of triggering type-related errors, boundary values ​​are also introduced, including extremely large or small numbers, as well as text containing mixed case. Furthermore, the sign (positive or negative) of certain columns is explicitly specified to test specific arithmetic operations and function-related mutation operators. Test Case Generation and Parsing. Similar to SQL generators such as sqlsmith and GO-randgen, VALSCOPE is implemented from scratch to generate the original query. VALSCOPE ensures consistency of data dependencies, function dependencies, and expression dependencies during query generation. It carefully selects tables and columns based on usage patterns, applies the correct functions with compatible parameter types, and maintains type compatibility in operations, thus guaranteeing semantic correctness. This makes VALSCOPE superior to existing generators such as SQLSMITH and GO-RANDGEN in semantic accuracy, especially when dealing with complex queries containing multiple nested subqueries. To apply the approximate mutant to the original query, SQLGLOT is used, which takes the same context-free grammar used to generate the seed query and generates an abstract syntax tree (AST) of the original query for mutation.

[0156] (2) Error Reporting Post-Processing. VALSCOPE evaluates the queries in the test database management system to obtain query results. It should be noted that inconsistent query results often occur during the testing process. To avoid duplicate error reports and make the test results easier to understand, we first use [a method to simplify errors and identify their root causes]. In addition, we follow the PINOLO method to remove duplicates.

[0157] (3) Supported Database Management Systems and Adaptability. VALSCOPE is primarily designed around MySQL syntax, ensuring robust support for MySQL-based databases such as TiDB and OceanBase. VALSCOPE's architecture is modular and decoupled, which facilitates easy adaptation to different database management languages. To integrate support for other database management languages, users only need to modify the relevant components to adapt to the specific syntax, data types, and operations of the target database management language. This adaptation is similar to extending SQLSMITH, which can be achieved with just a few hundred lines of code. An even simpler approach is to utilize the latest extension tool, QTRAN, which automates the process of supporting multiple database management language dialects using a metamorphic Oracle-based logical error detection technique.

[0158] To demonstrate the effectiveness of VALSCOPE, verification experiments were conducted on the following two questions.

[0159] Question 1 (Q1): Can VALSCOPE detect real logical errors in widely used and thoroughly tested database management systems?

[0160] Question 2 (Q2): Can VALSCOPE detect logical errors missed by existing methods?

[0161] VALSCOPE was evaluated on six widely used database management systems, as shown in Table 3. These database management systems were selected based on their popularity and widespread use in real-world applications. MySQL, MariaDB, TiDB, and OceanBase were widely used, with MySQL ranking second in the database engine rankings, MariaDB ranking 13th, and TiDB and OceanBase also being significant players. Percona (a derivative of MySQL) and PolarDB (a cloud-native database) were selected to represent a wider range of database management systems. All of these database management systems underwent extensive testing for logical and crash errors. While discovering new bugs in such a broadly tested system was challenging, this validated the effectiveness of VALSCOPE. In the experiment, VALSCOPE tested the latest version of each database management system. When any database management system was updated, a new test was launched on the updated version. The entire experiment took approximately one month.

[0162] Table 3 - Demographic characteristics of the subjects' database management systems (DBMS):

[0163]

[0164] The experiment was conducted on a server equipped with a 104-core Intel® Xeon® Gold 6230R CPU @ 2.10GHz and 500GB of memory. The server was running Ubuntu 20.04 with Linux kernel version 5.4.0-135-generic.

[0165] Table 4 summarizes the logical errors discovered by VALSCOPE in various database management systems. We reported a total of 62 unique logical errors across six database management systems: 19 in MySQL, 9 in MariaDB, 7 in OceanBase, 10 in Percona, 12 in PolarDB, and 5 in TiDB. Notably, all of these errors were previously undetected, demonstrating VALSCOPE's effectiveness in uncovering hidden logical contradictions. Of these, 44 errors have been confirmed, and 18 are still under investigation.

[0166] Table 4 - Logical error states detected by VALSCOPE:

[0167]

[0168] Further analysis revealed the query characteristics that triggered logical errors. Of the 44 confirmed errors, 35 involved subqueries, 13 were related to aggregate functions, and 5 stemmed from numerical calculations within expressions. Additionally, 12 errors were related to join operations, and 16 to GROUP BY and HAVING clauses. Since a single query can contain multiple structures, these categories are not mutually exclusive; rather, they demonstrate that VALSCOPE can detect logical errors arising from rich combinations of subqueries, aggregates, arithmetic expressions, joins, and GROUP BY clauses, rather than being limited to narrow query template categories.

[0169] All reported vulnerabilities were discovered using the SQL query approximation framework. Of all confirmed vulnerabilities, 36 ultimately violated the value semantic approximation principle, and 28 required reasoning about cross-dimensional propagation between set semantics and value semantics. These results demonstrate the effectiveness of VALSCOPE in jointly modeling set semantics and value semantics, enabling it to detect subtle logical vulnerabilities that are difficult to catch by traditional machine translation techniques based solely on equivalence or set semantic approximation.

[0170] Query generation efficiency was evaluated by measuring the number of test cases generated per second, with each test case containing the original query and its corresponding variant. VALSCOPE's query generation throughput is comparable to existing methods. Specifically, the generation rate is 2000 rows / second for MySQL, 1923 rows / second for MariaDB, 2000 rows / second for OceanBase, 1960 rows / second for Percona, 1960 rows / second for PolarDB, and 1960 rows / second for TiDB. In addition to its competitive throughput, VALSCOPE also achieved high execution success rates across most database management systems: 93% for MySQL, 88% for MariaDB, 87% for OceanBase, 91% for Percona, 72% for PolarDB, and 87% for TiDB. These results demonstrate that VALSCOPE can generate complex queries with nested structures and inter-query dependencies while maintaining data consistency, functional dependencies, and expression correctness. Although the testing campaign lasted nearly a month, most logical errors were discovered in the early stages, with many issues even detected on the first day of testing. This phenomenon demonstrates that VALSCOPE can quickly reveal potential logical flaws, making it ideal for efficient and practical database management system testing.

[0171] Further comparative studies were conducted between VALSCOPE and existing methods to evaluate whether VALSCOPE could detect logical errors missed by previous methods. The earliest versions of the 44 confirmed logical errors discovered by VALSCOPE were analyzed, and these versions were examined to see if they predated the publication dates of existing methods. This allowed us to assess the effectiveness of VALSCOPE in identifying long-standing problems overlooked by earlier technologies. As shown in Table 5, 34 of the 44 confirmed errors originated before 2020, indicating that all methods introduced after 2020 (such as PQS, TLP, and NOREC) failed to detect these long-standing problems in their extensive evaluations. Furthermore, 5 errors existed between 2020 and 2023 but were not identified by testing methods introduced after 2023, such as EET, PINOLO, TQS, DQE, and DQP. These findings suggest that existing methods indeed miss a large number of long-standing logical errors. These missed errors can be attributed to the fundamental limitations of existing methods. First, equivalence-based techniques like TLP apply coarse-grained query-level mutations, repeatedly using the same erroneous operators, causing two queries to return the same but incorrect results. Second, approximation-based methods like PINOLO rely solely on set semantics, thus failing to detect value-level errors that occur without modifying the tuple set. However, VALSCOPE infers both set and value semantic behavior simultaneously and performs fine-grained mutations, enabling it to reveal subtle errors that previous methods simply ignored.

[0172] Table 5 - Delays in identifying confirmed logical errors by VALSCOPE:

[0173]

[0174] Furthermore, the longest latency of identified errors in each database management system was investigated. As shown in Table 5, VALSCOPE identified at least one error with a latency exceeding three years in each tested database management system, with the longest latency reaching 20 years. These results demonstrate that VALSCOPE is highly effective in discovering long-standing, previously unknown logical errors in various database management systems.

[0175] Furthermore, variant testing is performed for logical error detection in database management systems. Existing technologies have proposed various variant testing methods to detect logical errors in database management systems. For example, NOREC converts optimizable queries into non-optimizable forms and detects semantic inconsistencies by comparing the output results. TLP breaks down query predicates into multiple subqueries and verifies whether the union of their results is equivalent to the original query. PQS constructs queries that are expected to retrieve specific pivot rows, while DQE detects logical errors by comparing whether different SQL queries with the same predicates access the same rows in the database. PINOLO extends this paradigm through set-level approximation, where predicates are relaxed or restricted to generate super-approximate and under-approximate queries, and correctness is judged by inclusion or coverage relationships between result sets. Existing variant testing methods are mainly limited to equivalence-based testing or set-level approximation. In contrast, embodiments of the present invention extend variant testing by jointly modeling set semantics and value semantic approximation, enabling the detection of logical errors that were undetectable in previous frameworks.

[0176] Furthermore, test case generation for database management systems (DBMS) is a key area of ​​research. Existing technologies have proposed various methods to generate diverse test cases for DBMS, aiming to improve coverage and uncover potential errors. These techniques typically focus on generating valid and diverse SQL queries but may not specifically target logical errors. SQLSMITH is a syntax-based DBMS fuzzing tool that embeds SQL syntax rules to generate complex SQL queries. It employs a random walk approach to explore SQL syntax and generate a wide range of queries. SQUIRREL is a mutation-based DBMS fuzzing tool that introduces intermediate representations of SQL queries and models dependencies between SQL statements, thereby generating queries containing multiple SQL operations. Griffin employs a syntax-free mutation approach, mutating SQL queries based on DBMS state information encapsulated in a metadata graph. QTRAN is a large language model-based approach that can automatically convert test cases from other DBMS into SQL queries. DYNSQL takes a dynamic approach, incrementally generating valid and complex queries by interacting with the DBMS to capture the latest state information. These techniques aim to prevent semantic errors and improve the diversity of generated queries. In addition to general query generation, some methods are specifically designed to assist in error detection. SQLRIGHT leverages code coverage feedback to enhance test case generation. QPG takes a different approach, recording query plans covered during database management system testing and prioritizing queries that trigger new query plans through mutation. These general query generation methods complement VALSCOPE. Tools like SQLSMITH, SQUIR-REL, and GRIFFIN focus on generating diverse queries, while VALSCOPE helps identify logical errors hidden in complex or infrequently executed query logic. Conversely, the test cases generated by these methods provide VALSCOPE with high-quality and diverse queries, enhancing its error detection capabilities. Overall, these methods offer a comprehensive strategy for database management system testing, improving both query coverage and logical error detection.

[0177] See Figure 4 The diagram shown is a structural schematic of a value semantic-aware metamorphosis testing system for detecting logical defects in DBMS, according to an embodiment of the present invention, comprising:

[0178] The raw query building module 401 designs the basic syntax for the DBMS under test to build raw queries;

[0179] The mutation query generation module 402 uses an approximate mutant to introduce local semantic biases into the original query and generate a mutation query.

[0180] Approximation propagation module 403 parses the original query and the modified query into an abstract syntax tree (AST) and performs approximation propagation to generate a query-level approximation relationship between the original query and the modified query.

[0181] The logic defect detection module 404 executes the original query and the variant query on the DBMS under test, collects the execution results and compares them with the query-level approximation relationship to determine whether there is a logic defect.

[0182] In summary, this invention proposes a unified SQL query approximation model that integrates set semantics and value semantics reasoning to detect logical errors in database management systems. Based on this model, a variant testing framework was developed to reveal deep logical contradictions by mutating SQL queries and propagating semantic approximations. Evaluation on six mainstream database management systems revealed 62 logical errors, of which 44 were confirmed at the time of submission.

[0183] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A value semantic-aware metamorphosis testing method for detecting logical defects in DBMS, characterized in that, Includes the following steps: The original query construction steps involve designing basic syntax for the DBMS under test to construct the original query. The mutation query generation process involves partially rewriting the original query to generate a mutation query, and the original query and the mutation query satisfy an approximation relationship. The approximate propagation step parses the original query and the mutated query into an abstract syntax tree (AST) and finds the propagation link of the local rewrite on the AST to generate a query-level approximate relationship between the original query and the mutated query. The logical defect detection step involves executing the original query and the variant query on the DBMS under test, collecting the execution results and comparing them with the query-level approximation relationship to determine whether there is a logical defect. The approximation relations include set-level approximation and value-level approximation, defined as follows: For set-level approximation, let q1 and q2 be two SQL queries, which, after execution on database D, yield result sets R(q1, D) and R(q2, D) respectively; the result set R(q1, D) is obtained if and only if R(q1, D) is satisfied. When R(q2, D), q1 is called a set-level underapproximation of q2 on D, denoted as q1 q2; if and only if R(q1, D) R(q2, D) is called a set-level hyperapproximation of q2 on D, denoted as q1. q2; For value approximation, let q1 and q2 be two SQL queries, which, after execution on database D, yield result sets R(q1, D) and R(q2, D) respectively; let Ct Cols(R(q1,D))∩Cols(R(q2,D)) represents the target column set for comparison, and Cols represents the selection column set. q1 is called a value-level super-approximation of q2 on D if and only if for all g∈G*, c∈Ct, Vq1(g,c)≥Vq2(g,c), denoted as q1. q2; otherwise, q1 is called an under-approximation of the order of q2, denoted as q1. q2; where G* represents the set of all comparable tuple groups under G, and G represents the grouping or sorting basis, which is determined as follows: if the query contains a GROUP BY clause, then G corresponds to the grouping key; otherwise, G indicates that non-target columns are deterministically sorted to align tuples for comparison; Vq(g, c) represents the column c value generated by query q in group g; The process of partially rewriting the original query to generate a mutated query is implemented using an approximate mutant. The approximate mutant is an operator that defines the applicable AST node types, the changes performed on the nodes, the direction of the changes, and the semantic level. The direction of the changes includes under-approximation and over-approximation. The semantic level includes set-level and value-level. The changes performed on the nodes include set semantic mutation and value semantic mutation. Set semantic mutation adjusts the range and composition of the result set by changing relational operations, predicate logic, and join types. Value semantic mutation interferes with the final output value by changing the calculation formula and statistical dimensions. The process of collecting execution results and comparing them with the query-level approximation relationship to determine whether there are logical defects includes two cases: For cases where the original query and the mutated query are semantically similar to sets, check whether the execution result set of the mutated query is a subset or superset of the execution result set of the original query; if so, there are no logical defects, otherwise there are logical defects; For cases where the original query and the mutated query are semantically similar to values, compare the values ​​in the target columns of the two queries to ensure that they satisfy the expected monotonic relationship, including increasing or decreasing; if so, there are no logical defects, otherwise there are logical defects.

2. The value semantic-aware metamorphosis testing method for DBMS logic defect detection according to claim 1, characterized in that, The design of the basic syntax for the DBMS under test to construct the original query adopts a syntax parsing model of the structured query language SQL, defines a complete set of syntax rules supported by the database query tool, and logically adopts Backus normal form (BNF) or its variants for construction, specifically including the following technical levels: Statement and Query Core Layer: Top-level statement structure, defining the statement sequence with Q as the core, supporting concurrency lock control via FORLM, and using WITH clause to implement recursive or non-recursive definition of common table expressions; Query core component, guided by the SELECT keyword, supports DISTINCT deduplication option, SL target column selection, FC data source reference, and optional integrated filtering, GB grouping aggregation, OB sorting and L pagination limit; Relational and set operation layer: multi-table association mechanism, supporting multiple join types, including inner join, left outer join, right outer join and cross join, and defining association Boolean expressions through ON BE.

3. The value semantic-aware metamorphosis testing method for DBMS logic defect detection according to claim 1, characterized in that, The approximate mutants include the following four types: Relational mutants are used to change how datasets are combined or excluded. Predicate mutants are used to modify query conditions; Aggregation mutants are used to change aggregation behavior; Expression mutators are used to modify arithmetic or logical expressions.

4. The value semantic-aware metamorphosis testing method for DBMS logic defect detection according to claim 1, characterized in that, The process of parsing the original query and the mutated query into an Abstract Syntax Tree (AST) and finding the propagation path of the local rewrite on the AST to generate a query-level approximation relationship between the original query and the mutated query includes the following steps: The AST parsing steps parse the original query and the mutated query into an abstract syntax tree (AST), identify the modified nodes in the mutated query, and construct an ancestor chain from the modified nodes to the query root node. The initialization steps include the initialization of the semantic level and the change direction; if the mutated node involves a predicate or subquery, the semantic level is initialized to the set level; if the mutated node involves an expression or aggregation operation, the semantic level is initialized to the value level; the direction sign is initialized to +1; a direction sign of +1 indicates that the change direction is super approximation, and a direction sign of -1 indicates that the change direction is under-approximation. The propagation step iterates through each node in the ancestor chain from bottom to top, checking whether each node is semantically dependent on its modified child node. If so, the propagation operation is performed until the root node is reached, generating the final query-level approximation relationship between the original query and the modified query; and returning a set-level or numerical semantic approximation based on the semantic level of the root node and the propagation direction. The propagation operation includes updating the node based on the semantic mapping corresponding to the node's operator and its monotonic direction.

5. The value semantic-aware metamorphosis testing method for DBMS logic defect detection according to claim 4, characterized in that, The process of checking whether each node semantically depends on its modified child nodes, and only propagating the changes to dependent nodes, specifically involves: If the child node level is value level, then when the column or alias of the child node appears in the parent node expression, it will be propagated. If the child node level is set level, then when the parent node references the child node in a subquery or table-based manner, the reference is propagated. Otherwise, it will not be disseminated.

6. The value semantic-aware metamorphosis testing method for DBMS logic defect detection according to claim 4, characterized in that, The update based on the semantic mapping corresponding to the operator of the node and its monotonic direction includes the following steps: The semantic mapping and monotonic direction of the operator are found in the predefined operator monotonicity table; The semantic level is updated based on the semantic mapping, represented as α←α_out, where α represents the current semantic level, ← represents assignment, and α_out represents the output level of the corresponding semantic mapping; The direction sign is updated by multiplying by the monotonic direction, denoted as sign ← sign • σ(o pi), where sign represents the current direction sign and σ(o pi) represents the corresponding monotonic direction.

7. A value semantic-aware metamorphosis testing system for detecting logical defects in DBMS, characterized in that, include: The raw query building module designs the basic syntax for the DBMS under test to build raw queries; The mutation query generation module partially rewrites the original query to generate a mutation query, and the original query and the mutation query satisfy an approximate relationship. The approximation propagation module parses the original query and the modified query into an abstract syntax tree (AST) and finds the propagation link of the local rewrite on the AST, generating a query-level approximation relationship between the original query and the modified query. The logic defect detection module executes original queries and variant queries on the DBMS under test, collects the execution results and compares them with the query-level approximation relationship to determine whether there are any logic defects. The approximation relations include set-level approximation and value-level approximation, defined as follows: For set-level approximation, let q1 and q2 be two SQL queries, which, after execution on database D, yield result sets R(q1, D) and R(q2, D) respectively; the result set R(q1, D) is obtained if and only if R(q1, D) is satisfied. When R(q2, D), q1 is called a set-level underapproximation of q2 on D, denoted as q1 q2; if and only if R(q1, D) R(q2, D) is called a set-level hyperapproximation of q2 on D, denoted as q1. q2; For value approximation, let q1 and q2 be two SQL queries, which, after execution on database D, yield result sets R(q1, D) and R(q2, D) respectively; let Ct Cols(R(q1,D))∩Cols(R(q2,D)) represents the set of target columns for comparison; G represents the grouping or sorting criterion, which is determined as follows: if the query contains a GROUP BY clause, then G corresponds to the grouping key; otherwise, G represents a deterministic sorting of non-target columns to align tuples for comparison; q1 is called a value-level super-approximation of q2 on D if and only if for all g∈G*, c∈Ct, Vq1(g,c)≥Vq2(g,c), denoted as q1 q2; otherwise, q1 is called an under-approximation of the order of q2, denoted as q1. q2; where G* represents the set of all comparable tuples under G, and Vq(g, c) represents the column c value generated by query q in group g; The process of partially rewriting the original query to generate a mutated query is implemented using an approximate mutant. The approximate mutant is an operator that defines the applicable AST node types, the changes performed on the nodes, the direction of the changes, and the semantic level. The direction of the changes includes under-approximation and over-approximation. The semantic level includes set-level and value-level. The changes performed on the nodes include set semantic mutation and value semantic mutation. Set semantic mutation adjusts the range and composition of the result set by changing relational operations, predicate logic, and join types. Value semantic mutation interferes with the final output value by changing the calculation formula and statistical dimensions. The process of collecting execution results and comparing them with the query-level approximation relationship to determine whether there are logical defects includes two cases: For cases where the original query and the mutated query are semantically similar to sets, check whether the execution result set of the mutated query is a subset or superset of the execution result set of the original query; if so, there are no logical defects, otherwise there are logical defects; For cases where the original query and the mutated query are semantically similar to values, compare the values ​​in the target columns of the two queries to ensure that they satisfy the expected monotonic relationship, including increasing or decreasing; if so, there are no logical defects, otherwise there are logical defects.

Images