# LogRESP-Agent: A Recursive AI Framework for Context-Aware Log Anomaly Detection and TTP Analysis
## 3 Proposed Method
### Recursive Reasoning Framework for Log Analysis  
To enable contextual and autonomous interpretation of log anomalies, we propose a recursive reasoning framework powered by a Large Language Model (LLM)-based agent. This framework is formally described in Algorithm 1, which outlines the core logic of the agent's recursive reasoning loop and illustrates how log analysis progresses through sequential planning, action, and evaluation steps. Unlike traditional pipelines that rely on static rules or single-pass inference, our framework employs a structured plan-act-observe loop that supports adaptive, multi-step reasoning. As illustrated in Figure 2, the reasoning process is divided into three stages: Planning, Execution, and Reasoning. Figure 1: Overall architecture of the proposed LLM-based anomaly analysis framework, comprising three key stages: (1) Goal Planning—the agent interprets the user-defined objective and selects appropriate tools; (2) Dynamic Tool Execution—internal modules are invoked to extract anomaly scores, rule matches, and contextual information; and (3) Reasoning and Explanation—the agent synthesizes evidence, iteratively refines its hypothesis, and generates a natural language report. ```
1:Input: Semantic Log Description \(D\), Analysis Goal \(G\). 2:Output: Final Explanation \(E\)
3: Initialize ObservationList \(\leftarrow\) []
4: Initialize ThoughtHistory \(\leftarrow\) []
5: While True do
6:Stage 1: Planning
```  
```
1:Generate a new hypothesis \(h_{t}\):
2:\(\textbf{thought}\leftarrow\textbf{GenerateThought(D,G,ObservationList)}\)
3:Select the most relevant tool:
4:\(\textbf{tool}\leftarrow\textbf{SelectTool(thought)}\)
7:Stage 2: Execution
```  
3:Invoke the selected tool and get result:
5:result \(\leftarrow\)Invoke(tool,D)
8:Stage 3: Reasoning ```
d. Update observation and thought history:
6:\(\textbf{ObservationList}\leftarrow\textbf{ObservationList}\cup\textbf{result}\)
7:\(\textbf{ThoughtHistory}\leftarrow\textbf{ThoughtHistory}\cup\textbf{thought}\)
8:e. Determine if reasoning can be concluded:
9:if IsSufficient(result, ObservationList):
10:E\(\leftarrow\textbf{GenerateExplanation(D,G,ObservationList)}\) break
11:Return \(E\)
```

**Algorithm 1**Recursive Anomaly Analysis Loop

### Planning Strategy Formulation

The reasoning process begins with a user-defined or system-triggered analysis goal--such as _\"Explain the anomaly detected at time TM\"_ or _\"Determine whether process \(A\) is malicious\"_. Based on this goal, the agent retrieves the corresponding log record and

Figure 2: TAO reasoning loop. Recursive process of hypothesis generation, tool invocation, and evidence evaluation executed by the LLM-based agent. generates a semantic description \(D\), extracting key fields such as process name, parent lineage, path, privilege level, and execution context. Based on this description, the agent formulates a hypothesis \(h_{t}\) about the nature of the observed behavior and selects the most relevant tool to investigate further. This step is guided by its internal knowledge of typical attack patterns and known threat signatures, which inform the selection of the most relevant investigative tool. Tool selection is guided by a utility function, as follows:

\[tool_{t}=\underset{T_{j}\in T}{\text{\emph{max}}}\left[\mu_{1}\text{-}\text{ \emph{relevance}}\big{(}T_{j},\ G\big{)}+\mu_{2}\text{-}\text{\emph{expected}} \text{\emph{gain}}\big{(}T_{j},\ O_{1:t-1}\big{)}\right] \tag{1}\]

In Equation (1), the utility function estimates the suitability of each tool \(T_{j}\in\mathcal{T}\) based on two factors: its relevance to the analysis goal and its expected information gain. The term relevance \(\big{(}T_{j},\ G\big{)}\) refers to the semantic alignment between the tool's function and the analysis objective--for example, _RuleMatcher_ aligns well with the detection of known threat patterns, while _DescriptionGenerator_ is more suited for explanation-oriented goals.