# LogRESP-Agent: A Recursive AI Framework for Context-Aware Log Anomaly Detection and TTP Analysis
## 3 Proposed Method
### Recursive Reasoning Framework for Log Analysis
\begin{table}
\begin{tabular}{c c c c c c} \hline \multirow{2}{*}{**Configuration**} & \multicolumn{2}{c}{**Anomaly Detection**} & \multicolumn{2}{c}{**Multi-Class Classification**} & \multicolumn{2}{c}{**Multi-Class Classification**} \\  & **(LogRESP-Agent with LogBERT)** & **(LogRESP-Agent with RP)** & **(LogRESP-Agent with XGBoost)** \\ \cline{2-6}  & **F1-Score (\%)** & **Change** & **F1-Score (\%)** & **Change** & **F1-Score (\%)** & **Change** \\ \hline Full LogRESP-Agent & 97.00 & - & 98.25 & - & 99.47 & - \\ \hline RuleMatcher removed & 93.08 & \(\downarrow\) 3.92 & 94.18 & \(\downarrow\) 4.07 & 95.43 & \(\downarrow\) 4.04 \\ \hline SequenceScore removed & 94.43 & \(\downarrow\) 2.57 & 95.42 & \(\downarrow\) 2.83 & 96.75 & \(\downarrow\) 2.72 \\ \hline TTPMapper removed & 95.31 & \(\downarrow\) 1.69 & 93.74 & \(\downarrow\) 4.51 & 95.16 & \(\downarrow\) 4.31 \\ \hline ThreatLookup removed & 95.87 & \(\downarrow\) 1.13 & 96.88 & \(\downarrow\) 1.37 & 98.30 & \(\downarrow\) 1.17 \\ \hline \end{tabular}
\end{table} 
Table 10: F1-score drop (%) when removing individual modules from LogRESP-Agent across three configurations: LogRESP-Agent (anomaly detection), LogRESP-Agent with random forest (multi-class classification), and LogRESP-Agent with XGBoost (multi-class classification). Performance drop is reported relative to the full LogRESP-Agent baseline. its component tools--such as _RuleMatcher_ and _SequenceScorer_--and its robustness against sophisticated zero-day threats remains to be evaluated in adversarial environments. To address these limitations, future work will extend the framework toward proactive response capabilities, including mitigation recommendations like host isolation or process termination. We also plan to enhance cross-format and multilingual log processing to support broader operational environments. In addition, testing the agent's resilience against evasive attack strategies will be a priority, helping to advance LogRESP-Agent toward becoming a more autonomous and robust security co-pilot. Beyond system-level improvements, several methodological extensions are envisioned. The current heuristic-based tool selection strategy will be refined into a trainable utility model to enable more adaptive and data-driven reasoning. To enhance the interpretability and usability of the agent's outputs, future work will incorporate human-centered feedback to assess and refine the clarity, relevance, and practical trustworthiness of generated explanations within real-world analyst workflows. ## 6 Conclusions

In this study, we proposed LogRESP-Agent, a modular AI framework that integrates log-based anomaly detection with contextual explanation capabilities. The system is driven by a high-performance Large Language Model (LLM), which dynamically orchestrates a suite of specialized tools--including pattern-based detection, sequence scoring, TTP mapping, and natural language generation--to support fine-grained threat classification and interpretable decision-making. We evaluated LogRESP-Agent on both anomaly detection and multi-class classification tasks using the Monster-THC and EVTX-ATTACK-SAMPLES datasets. Across both settings, the proposed framework consistently outperformed conventional baselines--including standalone models (MLP, RF, XGBoost) and unsupervised methods (Autoencoder, LogBERT)--achieving up to 99.97% accuracy and 0.0 false positive rate in anomaly detection, and 0.99 F1-score in multi-class classification. It also maintained high true positive rates and robust performance across difficult attack categories such as Credential Access and Privilege Escalation. Beyond detection performance, Table 1 summarizes the broader system-level advantages of LogRESP-Agent over recent Transformer- and LLM-based anomaly detection models. Compared to models such as LogBERT, LogGPT, and Audit-LLM, LogRESP-Agent uniquely supports unstructured log reasoning, parser-free operation, autonomous goal-driven analysis, and dynamic multi-tool integration.