# LogRESP-Agent: A Recursive AI Framework for Context-Aware Log Anomaly Detection and TTP Analysis
## 3 Proposed Method
### Recursive Reasoning Framework for Log Analysis
In summary, LogRESP-Agent offers consistent, interpretable, and highly reliable performance across all process types, confirming its effectiveness in real-world endpoint anomaly detection. ### Multi-class Classification Performance on EVTX-ATTACK-SAMPLES

We further assessed LogRESP-Agent's ability to classify malicious logs into specific MITRE ATT&CK tactics using the EVTX-ATTACK-SAMPLES dataset. The agent was benchmarked against MLP, Random Forest (RF), and XGBoost, with performance evaluated across eight attack tactics. As shown in Table 8, the XGBoost-based variant of LogRESP-Agent achieved the highest average TPR (0.99), FPR (0.001), Accuracy (0.99), and F1-score (0.99). Although the overall margin of improvement (-1%) over XGBoost may seem small, it reflects notable gains in harder classes like Credential Access and Privilege Escalation, where baselines showed degraded recall or increased false positives. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Model** & **Mean F1-Score (\%)** & **Std. Dev.** \\ \hline Autoencoder & 80.96 & \(\pm\)1.10 \\ \hline LogBERT & 83.52 & \(\pm\)0.99 \\ \hline LogRESP-Agent & 97.37 & \(\pm\)0.57 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: [PERSON]’s \(t\)-test. Mean F1-score and standard deviation for anomaly detection (Monster-THC dataset). \begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Tactic**} & \multicolumn{4}{c}{**MLP**} & \multicolumn{4}{c}{**RF**} & \multicolumn{4}{c}{**XGBoost**} & \multicolumn{4}{c}{**LogRESP-Agent**} & \multicolumn{4}{c}{**LogRESP-Agent**} \\  & **TPR** & **FPR** & **Acc** & **F1** & **TPR** & **FPR** & **Acc** & **F1** & **TPR** & **FPR** & **Acc** & **F1** & **TPR** & **FPR** & **Acc** & **F1** & **TPR** & **FPR** & **Acc** & **F1** \\ \hline Command & 0.98 & 0.004 & 0.99 & 0.98 & 0.97 & 0.0 & 0.99 & 0.98 & 0.99 & 0.0 & 0.99 & 0.99 & 0.0 & 0.99 & 0.0 & 0.99 & 1.0 & 0.0 & 1.0 & 1.0 \\ \hline Credential & 0.81 & 0.017 & 0.97 & 0.80 & 0.81 & 0.003 & 0.98 & 0.87 & 0.96 & 0.003 & 0.99 & 0.96 & 0.96 & 0.002 & 0.98 & 0.96 & 0.97 & 0.002 & 0.99 & 0.97 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Multi-class Classification performance of LogRESP-Agent compared with baseline models on the EVTX-ATTACK-SAMPLES datasets. The highlights include the following:

* **Command and Control**: All models performed well (F1 \(\geq\) 0.98), but only the agent variant achieved full recall (TPR = 1.0, F1 = 1.0) with zero false positives. * **Credential Access**: A challenging tactic for baselines--MLP and RF scored F1 \(\leq\) 0.87. The agent variants improved this to 0.96 (RF) and 0.97 (XGBoost) with very low FPRs (\(\leq\)0.002). * **Defense Evasion and Persistence**: Involving stealthy or multi-stage behaviors, these classes saw consistent improvements from the agent variants, reaching F1 = 0.97 while keeping FPRs \(\leq\) 0.003. * **Discovery and Execution**: Easier to detect, all models performed well, but LogRESP-Agent again maintained near-perfect scores (F1 \(\geq\) 0.99, FPR = 0.0). * **In Lateral Movement and Privilege Escalation**: While some baselines showed reduced F1 (0.87-0.90), LogRESP-Agent sustained F1 = 0.99-1.0 with minimal false positives. By combining tree-based classifiers with recursive analysis, contextual reasoning, and TTP mapping, LogRESP-Agent delivers fine-grained and interpretable classifications across all tactics. The framework not only improves raw accuracy but also enhances tactical alignment--a critical requirement for operational threat analysis. To assess the consistency and statistical strength of the observed improvements in multi-class classification, we conducted [PERSON]'s _t_-tests based on five independent experimental runs for each model. As shown in Table 9, LogRESP-Agent combined with XGBoost achieved an average F1-score of 98.96% (\(\pm\)0.10), significantly surpassing baseline models such as MLP (91.00% \(\pm\) 0.14) and Random Forest (93.00% \(\pm\) 0.14).