Rethinking MVC Violations as Security-Aware Architectural Smells in Android Applications

MVCDroid is a large-scale dataset of architectural metrics for Android applications, created to support empirical research at the intersection of software architecture and mobile security. The dataset contains 3,568 Android applications, comprising 2,041 benign apps and 1,527 malware samples. Each application was processed through a static bytecode analysis pipeline to extract structural information relevant to Model-View-Controller (MVC) separation. The dataset includes three application-level metrics that characterize MVC separation properties: Separation Score (SepVC), Controller UI Entanglement (CUE), and Controller UI Density (CUD). These metrics are derived from bytecode-extracted structural quantities, namely UI view instantiations within controller classes, UI view instantiations outside controller classes, and the total number of classes in the application. Each record also includes the application’s binary label (Benign or Malware) and its SHA-256 hash, enabling reproducibility and independent retrieval. MVCDroid supports research on Android software architecture, architectural smells, structural analysis of benign and malicious applications, and security-aware architectural assessment. The dataset is particularly useful for studying whether deviations from MVC separation exhibit systematic differences across app populations and for enabling reproducible follow-up studies on architecture-level signals in Android security. If you use this dataset, please cite the associated paper describing MVCDroid. @inproceedings{MVCDroid, author = {Mohamed Sylla and Karim Elish}, title = {Rethinking MVC Violations as Security-Aware Architectural Smells in Android Application}, booktitle = {23rd IEEE International Conference on Software Architecture (ICSA)}, year = {2026}} App Access Information: The applications referenced in this dataset are real-world Android applications. To comply with research ethics guidelines and application redistribution policies, APK files are not distributed as part of this release. Researchers should retrieve the applications from the official AndroZoo repository using the SHA-256 identifiers provided in the dataset. AndroZoo: https://androzoo.uni.lu/ Usage Instructions: Request access to the AndroZoo repository through its official website.Use the SHA-256 hashes included in MVCDroid to retrieve the corresponding applications.Use the released metrics and metadata for replication, benchmarking, or further empirical analysis.