CypherFuzzer - a framework for generating fuzz queries in Cypher

In cases where the data needs to be tightly interconnected, graph databases are used: from social networks and weather forecasts to fraud detection. Relational databases do not offer the required flexibility in those scenarios. However, graph databases also pose a risk from a security and data protection perspective: By analyzing the connected data, it may be possible to draw (sometimes unintended) conclusions. Due to this fact, it is necessary for graph databases to also include an access-control system. Most of the existing approaches in this field may work when using relational databases, but due to the way graph databases work, these cannot be applied without restrictions. Among others, there are two approaches for graph databases: (1) Certain nodes are prevented from being traversed or (2) the query is modified in a way that only valid data is returned. In order to ensure the security of data and privacy, it is important that the systems used to monitor the access control work as intended. This work gives an overview of how graph databases work and elaborates on their theoretical background. In addition, this thesis discusses “fuzzing”, the automatic creation of input for applications with the goal of unveiling vulnerabilities and errors in the implementation. Furthermore, it describes the automatic creation of queries for the database query language Cypher. Related approaches of creating Cypher queries primarily focus on testing the implementation of the database engine in its core functionalities. However, those approaches have not been developed with a focus on access control systems. In the process of writing this paper, a prototype was developed that allows the generation of random Cypher queries to test such systems. CypherFuzzer has been developed using the programming language Kotlin and a domain-specific language (DSL) [60] to ensure the semantic correctness of the generated queries. It is able to create Cypher queries based on random or real-world databases, which can be configured to feature certain attributes, like the number of conditions. The results show that the prototype can create semantically valid queries and that these generated queries can yield non-empty result sets.