Demonstration venue · read-only. Every page can be browsed; the buttons that would change it are switched off. Create an account to run TaxoReview on your own data. A simulation from public publication records: the people listed were not invited and did not agree to review.
? Tutorial for this page

Yaoguang Chen

dblp:352/6701 · DBLP profile ↗
← Back
2ranked-venue papers
0as first author
2since 2021 · last 2025
—ORCID · none

Domains — the database's venue-derived domains; a paper can count in several

Security and privacy · 1 · 1 since 2021Databases, data management, data science and information retrieval · 1 · 1 since 2021

Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.

Software engineering, system software, and programming languages
1 paper
Software testing · 100%

Topics — the 2 heaviest of 3, each with the papers that count most for it

TopicWeightPapersLastEvidence papers
Software testing › fuzzing › system software fuzzing
DBMS fuzzing
0.712023
Sequence-Oriented DBMS Fuzzing · ICDE 2023
Software testing
fuzzing
0.712023
Sequence-Oriented DBMS Fuzzing · ICDE 2023

Methods — techniques the papers use, named apart from their topics

type-affinity analysis · 0.7coverage-guided fuzzing · 0.7
YearPublicationVenuePosition
2025 Detecting DBMS bugs with context-sensitive instantiation and multi-plan execution
Jiaqi Li 0023, Ke Wang 0042, Yaoguang Chen, Yajin Zhou, Lei Wu 0012, Jiashui Wang
Comput. Secur.3
2023 Sequence-Oriented DBMS Fuzzing
abstract
The SQL specification consists of hundreds of statement types, which leads to difficulties in DBMS fuzzing: state-of-the-art works generally reuse the statements of predefined types; the limited types cannot cover the full input space and test the corresponding logic consequently. In this paper, we propose Lego, a fuzzer to generate SQL sequences with abundant types to improve DBMS fuzzing coverage. The key idea of sequence generation is type-affinity, which indicates the meaningful occurrence of SQL type pairs (e.g., INSERT and SELECT). During each fuzzing iteration, Lego first proactively explores SQL statements of different types and analyzes affinities with coverage feedback. Next, when a new affinity is discovered, Lego synthesizes new SQL sequences containing the types progressively.We evaluate Lego on PostgreSQL, MySQL, MariaDB, and Comdb2 against SQLancer, SQLsmith, and Squirrel. The sequence-oriented fuzzing helps Lego outperform other fuzzers on branch coverage by 44%–198%. More importantly, in the continuous fuzzing, Lego has discovered 102 new vulnerabilities confirmed by the corresponding vendors, including 6 bugs in PostgreSQL, 21 bugs in MySQL, 42 bugs in MariaDB, and 33 bugs in Comdb2. Among them, 22 CVEs have been assigned due to their severe security influences.
Jie Liang 0006, Yaoguang Chen, Zhiyong Wu 0010, Jingzhou Fu, Yu Jiang 0001, Xiangdong Huang 0001, Ting Chen 0002, Jiashui Wang
ICDE2