# LogRESP-Agent: A Recursive AI Framework for Context-Aware Log Anomaly Detection and TTP Analysis
## 3 Proposed Method
### Recursive Reasoning Framework for Log Analysis
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Dataset**} & \multicolumn{2}{c}{**Category**} & \multirow{2}{*}{**Benign**} & \multirow{2}{*}{**Malicious**} & \multirow{2}{*}{**Total**} \\ \cline{3-4}  & **(Process/Tactic)** & & & \\ \hline \multirow{3}{*}{Monster-THC} & Chrome & 30,036 & 150 & 30,186 \\ \cline{2-5}  & Edge & 1192 & 61 & 1253 \\ \cline{2-5}  & Hwp & 2044 & 76 & 2120 \\ \hline \multirow{3}{*}{EVTX-ATTACK-SAMPLE} & Command and Control & - & 440 & 440 \\ \cline{2-5}  & Credential Access & - & 218 & 218 \\ \cline{2-5}  & Defense Evasion & - & 283 & 283 \\ \cline{2-5}  & Discovery & - & 146 & 146 \\ \cline{2-5}  & Execution & - & 381 & 381 \\ \cline{2-5}  & Lateral Movement & - & 1122 & 1122 \\ \cline{2-5}  & Persistence & - & 163 & 163 \\ \cline{2-5}  & Privilege Escalation & - & 414 & 414 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Distribution of the Datasets Used for Anomaly Detection and Multi-Class Classification Tasks. ### Monster-THC Endpoint Log

This dataset was collected using the _Monster Agent_, a system-level event collector that serves as the endpoint component of the Monster Threat Hunting Cloud (THC) platform. While Monster Agent collects a wide range of system events--including process, network, and system-level activities--we selected process creation events (Event ID 1500) for this study. These logs correspond to execution activities of _Chrome_, _Edge_, and _Hwp_ applications in a real-world Windows enterprise environment. The dataset contains 33,559 samples in total--33,272 labeled as benign and 287 as malicious--covering various attack types such as _Execution_, _Privilege Escalation_, and _Defense Evasion_. For the purposes of this study, we used the binary labels to evaluate the agent's performance in distinguishing normal and malicious behavior in real-world logs. ### EVTX-ATTACK-SAMPLES [42]

The second dataset was constructed from the EVTX-ATTACK-SAMPLES [42] repository, which contains evtx Windows logs corresponding to known adversarial behaviors. After converting the logs to structured CSV format, we used the provided MITRE ATT&CK tactic labels to annotate each sample. The dataset includes 3167 malicious logs spanning eight attack categories--such as _Command and Control_, _Privilege Escalation_, and _Lateral Movement_--and was used to evaluate the agent's ability to classify specific attack types and generate appropriate explanations. These datasets were used to evaluate the agent's classification performance and explanatory capabilities in separate binary and multi-class settings, as described in Section 4.2. Both datasets were divided into training and testing sets using an 80/20 split, with class distributions preserved to ensure balanced representation. Cross-validation was not performed, as the recursive reasoning mechanism of LogRESP-Agent focuses on interpretability and traceability rather than repeated training cycles. Although the Monster-THC dataset exhibits class imbalance (33,272 benign vs. 287 malicious samples), this had minimal impact on the evaluation process. Since LogRESP-Agent performs unsupervised inference by modeling normal behavior and identifying deviations, it does not rely on balanced class distributions for training. Instead, detection is based on assessing deviation from learned benign patterns, making it less sensitive to class skew during training. Performance was evaluated using the F1-score, True Positive Rate (TPR), and False Positive Rate (FPR), which are appropriate metrics for imbalanced classification tasks. ### Experimental Configuration: Agent Components and Baselines

To evaluate both the detection performance and the interpretability of the proposed AI Agent, we conducted experiments on anomaly detection and multi-class attack classification. This section outlines the internal configuration of the agent and the baseline methods used for comparative evaluation.