Research on Coverage Statistics in Fuzz Testing of Closed-Source DBMS

A Database Management System (DBMS) is widely used as application software for managing business data, and its security is of paramount importance. Any form of data leakage or corruption may lead to significant security issues. Currently, publicly available research on vulnerability detection for closed-source DBMSs remains relatively limited. To achieve effective testing of closed-source DBMSs, this paper proposes a novel coverage analysis method based on execution path monitoring to collect real-time coverage data of closed-source DBMSs. The method utilizes coverage feedback to guide seed scheduling in fuzz testing. Based on this approach, a coverage tracker named TrCov for closed-source DBMSs was implemented. TrCov was used to test two DBMSs, Oracle and SQL Server, and the experimental results validated the effectiveness of the tool.