Demo Data from VLDB 2026 / reviewers in the wild / expert
Yaoguang Chen
dblp:352/6701
· DBLP profile ↗
2ranked-venue papers
0as first author
2since 2021 · last 2025
—ORCID · none
Domains — the database's venue-derived domains; a paper can count in several
Security and privacy · 1 · 1 since 2021Databases, data management, data science and information retrieval · 1 · 1 since 2021
Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.
| Software engineering, system software, and programming languages
1 paper |
Software testing · 100% |
Topics — the 2 heaviest of 3, each with the papers that count most for it
| Topic | Weight | Papers | Last | Evidence papers |
|---|---|---|---|---|
Software testing › fuzzing › system software fuzzing
DBMS fuzzing |
0.7 | 1 | 2023 | Sequence-Oriented DBMS Fuzzing · ICDE 2023 |
Software testing
fuzzing |
0.7 | 1 | 2023 | Sequence-Oriented DBMS Fuzzing · ICDE 2023 |
Methods — techniques the papers use, named apart from their topics
type-affinity analysis · 0.7coverage-guided fuzzing · 0.7
| Year | Publication | Venue | Position |
|---|---|---|---|
| 2025 | Detecting DBMS bugs with context-sensitive instantiation and multi-plan execution
Jiaqi Li 0023, Ke Wang 0042, Yaoguang Chen, Yajin Zhou, Lei Wu 0012, Jiashui Wang |
Comput. Secur. | 3 |
| 2023 | Sequence-Oriented DBMS FuzzingabstractThe SQL specification consists of hundreds of statement types, which leads to difficulties in DBMS fuzzing: state-of-the-art works generally reuse the statements of predefined types; the limited types cannot cover the full input space and test the corresponding logic consequently. In this paper, we propose Lego, a fuzzer to generate SQL sequences with abundant types to improve DBMS fuzzing coverage. The key idea of sequence generation is type-affinity, which indicates the meaningful occurrence of SQL type pairs (e.g., INSERT and SELECT). During each fuzzing iteration, Lego first proactively explores SQL statements of different types and analyzes affinities with coverage feedback. Next, when a new affinity is discovered, Lego synthesizes new SQL sequences containing the types progressively.We evaluate Lego on PostgreSQL, MySQL, MariaDB, and Comdb2 against SQLancer, SQLsmith, and Squirrel. The sequence-oriented fuzzing helps Lego outperform other fuzzers on branch coverage by 44%–198%. More importantly, in the continuous fuzzing, Lego has discovered 102 new vulnerabilities confirmed by the corresponding vendors, including 6 bugs in PostgreSQL, 21 bugs in MySQL, 42 bugs in MariaDB, and 33 bugs in Comdb2. Among them, 22 CVEs have been assigned due to their severe security influences. Jie Liang 0006, Yaoguang Chen, Zhiyong Wu 0010, Jingzhou Fu, Yu Jiang 0001, Xiangdong Huang 0001, Ting Chen 0002, Jiashui Wang |
ICDE | 2 |