GenPRD: An LLM workflow for automating mobile malware gap detection

Mobile malware researchers work relentlessly to stay one step ahead of attackers. Their mission is to identify malicious mobile applications on customer devices, understand their behaviour and translate those insights into detection signatures that alert their clients—in this instance, banking clients—in real time. Sounds straightforward until you remember that malware authors never sit still.

Malware families evolve rapidly, behaviours shift overnight and detection logic grows increasingly complex. Each signature often includes multiple logical components, turning the process into an endless game of whack‑a‑mole. Effective? Yes. Scalable? Not so much.

To simplify and accelerate this process, IBM Trusteer developed GenPRD a lightweight but powerful LLM‑based workflow that automates the discovery of detection gaps. GenPRD compares an existing malware signature stored in a Jira PRD ticket and a group of currently undetected malware samples represented by mobile manifest attributes in JSON format. PRD is a product requirements document that describes the signature logic of a product, including purpose, features and capabilities, that a researcher may request from the developer team.

The system identifies gaps, summarizes them in plain language and even suggests signature improvements saving researchers time, effort and a few headaches.

The original manual workflow required opening Jira tickets, copying attributes one by one into analysis tools and manually spotting gaps, which could lead to human error. GenPRD replaces that process with a single automated flow (see diagram below). Same goal, dramatically less friction.

The workflow is built using LangGraph and watsonx.ai LLM APIs. For this use case, we selected Meta‑LLaMA-3.3-70B-Instruct, balancing reasoning depth with practical performance. Below is a walkthrough of the core nodes in the flow:

Jira Extractor: This node uses the Jira API to read PRD content and split detection logic into smaller components based on logical OR operators.

PRD attributes Extractor: Using the LLM, this node converts logic components into structured JSON based on a predefined schema. It uses two separate prompts: one for numeric attributes and another for string attributes. The prompts include example inputs and corresponding outputs.

Gaps Extractor: Here, a deterministic function compares existing malware attributes with generated logic attributes. Any mismatches are recorded as gaps. If multiple logic components exist, the flow iterates accordingly.

Summarization Extractor: Finally, the LLM summarizes the detected gaps in clear, researcher‑friendly language and proposes rule updates to close those gaps.

The diagram below presents the end-to-end flow, accompanied by a simple output example.

We built a simple Streamlit‑based UI and deployed GenPRD on Trusteer’s internal infrastructure (Lego). Input and output examples are shown below.

GenPRD is a textbook example of how AI can modernize legacy workflows without overengineering. By removing repetitive manual steps, researchers can spend more time on what really matters—deep malware analysis and faster response to emerging threats.

We’re currently collecting additional real‑world examples at IBM Trusteer to further refine the system. Future work includes:

• Automatically opening Jira tickets for signature updates.
• Experimenting with additional LLM models.
• Extending the workflow to new domains.

If this sparks ideas for improving your own workflows, mission accomplished.

Special thanks to Shahar Tavor, Bar Haim and Yaniv Oren for shaping the requirements, architecture and deployment of GenPRD.