BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//Computer Science - ECPv6.17.1//NONSGML v1.0//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:Computer Science
X-ORIGINAL-URL:https://csc.ncsu.edu
X-WR-CALDESC:Events for Computer Science
REFRESH-INTERVAL;VALUE=DURATION:PT1H
X-Robots-Tag:noindex
X-PUBLISHED-TTL:PT1H
BEGIN:VTIMEZONE
TZID:America/New_York
BEGIN:DAYLIGHT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
TZNAME:EDT
DTSTART:20250309T070000
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
TZNAME:EST
DTSTART:20251102T060000
END:STANDARD
BEGIN:DAYLIGHT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
TZNAME:EDT
DTSTART:20260308T070000
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
TZNAME:EST
DTSTART:20261101T060000
END:STANDARD
BEGIN:DAYLIGHT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
TZNAME:EDT
DTSTART:20270314T070000
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
TZNAME:EST
DTSTART:20271107T060000
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
DTSTART;TZID=America/New_York:20260701T133000
DTEND;TZID=America/New_York:20260701T143000
DTSTAMP:20260629T171143Z
CREATED:20260629T171143Z
LAST-MODIFIED:20260629T171143Z
UID:10000058-1782912600-1782916200@csc.ncsu.edu
SUMMARY:Beyond Bitwise: A Framework for Verifying the Equivalence of Binaries from Alternative Builds
DESCRIPTION:Abstract:\nSoftware supply chain attacks from SolarWinds and XZ Utils to compromised build pipelines have made it critical to verify that software binaries are trustworthy. A natural defense is to independently rebuild open-source projects and compare the resulting binaries\, an approach now taken by industry initiatives such as Google’s Assured Open Source Software and Oracle’s Build-From-Source. In practice\, however\, binaries rebuilt from identical source code are frequently not bitwise identical\, even when they are semantically equivalent. Naive bitwise comparison therefore produces too many false alarms\, while establishing full behavioral equivalence is undecidable. \nIn this talk we present a research program that addresses this challenge for Java. We begin by introducing a hierarchy of binary equivalence levels\, inspired by clone detection types\, which provides a practical and graded notion of equivalence between binaries produced by different builds. We then present BinEq\, a benchmark of over 600k labelled pairs of compiled Java classes that enables the systematic evaluation and training of equivalence relations. Finally\, we introduce DALEQ\, a novel tool that disassembles Java bytecode into a relational database and applies Datalog normalization rules to establish equivalence crucially\, with explainability: DALEQ produces Datalog proofs that record why two binaries are judged equivalent or non-equivalent\, giving security engineers the provenance they need to trust automated decisions. Evaluated on pairs of packages drawn from Maven Central and rebuilt by Oracle and Google\, DALEQ significantly outperforms the current state of the art\, reducing the manual inspection burden for non-bitwise-identical artifacts. \nWe close by outlining ongoing work that extends this program in two directions. First\, we are generalizing the equivalence levels and verification methodology to additional ecosystems Rust and Python where supply chain security concerns are equally pressing but the compilation and packaging models differ substantially. Second\, we are exploring AI-based equivalence classifiers that leverage the BinEq benchmark as training and evaluation data\, with the goal of learning equivalence relations that go beyond what hand-crafted normalization rules can express. Together\, these efforts aim to establish cross-ecosystem\, scalable binary verification as a practical component of modern software supply chain security. \nBio:\nJens Dietrich is an Associate Professor at Victoria University of Wellington\, New Zealand. He holds an MSc in Mathematics and a PhD in Computer Science from the University of Leipzig\, Germany. After completing his studies in 1996\, he worked in the software industry across Germany\, Switzerland\, the United Kingdom\, and Namibia before joining Massey University in 2003. He moved to Victoria University of Wellington in 2018. \nHis research focuses on software modularization\, software evolution\, and static program analysis. He is an executive member of Software Innovation New Zealand (SI^NZ) and collaborates closely with industry partners\, particularly Oracle Labs Australia. He currently co-leads a four-year\, NZD 7.8 million research program (20252029) on software supply chain security. \nMeeting Information:\nHost: Laurie Williams\nZoom URL: https://ncsu.zoom.us/j/93390983055?pwd=W164yW035Q6DyOI0oiSNnVMAQJ7lok.1\nZoom Meeting ID: 933 9098 3055\nZoom Passcode: 959501
URL:https://csc.ncsu.edu/event/beyond-bitwise-a-framework-for-verifying-the-equivalence-of-binaries-from-alternative-builds/
CATEGORIES:Lecture/Seminar
END:VEVENT
END:VCALENDAR