Looking through my log files it seems that most visitors that would be classified as "Bad bots" have a user agent string of Java/1.X

Are there any legitimate search engines that use this as a user agent? Is it safe to simply ban all visitors with a Java user agent?

Those are probably programs written by individuals using the HttpUrlConnection class

URL url = new URL("http://yahoo.com");
URLConnection con = url.openConnection();
HttpURLConnection http = (HttpURLConnection) con;
InputStream in = http.getInputStream();
.
.
.

I'd expect any organization to use the Jakarta Commons HttpClient package instead since it offers much greater functionality.

I'd just ignore it. It's probably just someone teaching themselves to code.