Oracles for the Equivalence of Java Bytecode

Novel approaches to improve software supply chain security hinge on the notion of binary equivalence. A naive notion based on bitwise equivalence is not suitable for this purpose, and a perfect solution is not possible due to the undecidability of functional equivalence. Pragmatic solutions rely on comprehensive datasets for the evaluation and/or training of classifiers. We present such a dataset for Java bytecode, consisting of several oracles for both equivalence and non-equivalence, extracted from software repositories and existing security databases. The dataset contains 277,727 pairs of equivalent (but different) and 169,651 pairs of non-equivalent (but similar) compiled classes extracted from real-world programs.