阅读笔记：DynSQL: Stateful Fuzzing for Database Management Systems with Complex and Valid SQL Query Gener

DynSQL和LEGO没有互相引用
前者2023.8 后者2023.4

Existing DBMS fuzzers always make a trade-off between complexity and validity of generated queries. For example, SQLsmith [43] generates only one statement in each query, avoiding the analysis of dependencies among statements, which sacrifices complexity for validity; SQUIRREL [48] uses an intermediate representation (IR) model to infer dependencies and generate queries
that contain multiple statements, but it produces over 50% invalid queries and tends to generate simple statements.
现有的fuzzer往往在query的复杂性和有效性中权衡：SQLsmith在每个query中只加入一条statement以避免分析statement的依赖关系分析；SQUIRREL使用中间表示（IR）推断依赖关系以生成更复杂的查询，但它生成的query超过50%不可用，且倾向于生成简单的statement。

Without accurate state information, these fuzzers tend to build incorrect dependencies among statements or misuse SQL features, causing many invalid queries to be generated. To generate valid test cases, these fuzzers have to limit the compl