# LogRESP-Agent: A Recursive AI Framework for Context-Aware Log Anomaly Detection and TTP Analysis
## 3 Proposed Method
### Recursive Reasoning Framework for Log Analysis
The corresponding _p_-values were 2.13 \(\times\) 10\({}^{-12}\) and 1.74 \(\times\) 10\({}^{-11}\), respectively, both indicating strong statistical significance (_p_ < 0.001). Even when compared to standalone XGBoost (98.02% \(\pm\) 0.13), the improvement was statistically significant (_p_ = 5.84 \(\times\) 10\({}^{-6}\)), validating that the improvements are robust and not due to experimental variance. Likewise, LogRESP-Agent combined with Random Forest achieved an average F1-score of 98.25% (\(\pm\)0.12), also yielding statistically significant improvements over MLP (_p_ = 4.58 \(\times\) 10\({}^{-11}\)) and standalone Random Forest (_p_ = 3.65 \(\times\) 10\({}^{-9}\)). In conclusion, LogRESP-Agent extends beyond conventional classifiers by coupling high-fidelity detection with rich semantic explanations, making it well-suited for real-world, threat-informed defense and automated TTP attribution. \begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Tactic**} & \multicolumn{3}{c}{**MLP**} & \multicolumn{3}{c}{**RF**} & \multicolumn{3}{c}{**XGBoost**} & \multicolumn{3}{c}{**LogRESP-Agent**} & \multicolumn{3}{c}{**LogRESP-Agent**} \\  & **TPR** & **FPR** & **Acc** & **F1** & **TPR** & **FPR** & **Acc** & **F1** & **TPR** & **FPR** & **Acc** & **F1** & **TPR** & **FPR** & **Acc** & **F1** & **TPR** & **FPR** & **Acc** & **F1** \\ \hline Defense & 0.87 & 0.007 & 0.98 & 0.90 & 0.91 & 0.008 & 0.98 & 0.91 & 0.95 & 0.003 & 0.99 & 0.95 & 0.94 & 0.001 & 0.98 & 0.95 & 0.97 & 0.003 &



### Explanation Analysis and Interpretability Evaluation

We also conduct a qualitative analysis to evaluate how well LogRESP-Agent explains its decisions. By reviewing three representative cases--one benign and one malicious log entry from the binary classification task, and one complex threat scenario from the multi-class classification setting--we assess the alignment between the agent's reasoning outputs and the actual attack context. **(1) Case 1. Normal Chrome Execution (Monster-THC, Log ID: 1671)**

In this scenario from the anomaly detection task, LogRESP-Agent analyzes a benign log entry corresponding to a Chrome process execution. The reasoning flow begins with the _DescriptionGenerator_, which produces a natural language summary of the event by extracting key attributes such as the parent process and command-line arguments. Rule-Matcher and _SequenceScorer_ are then invoked, both returning benign outcomes--no known malicious patterns were found, and the log was evaluated as normal by the AI model. The complete reasoning trace for this case is shown in Figure 3.

Figure 3: Reasoning trace and final output of LogRESP-Agent for a benign Chrome log entry (#1671). \begin{table}
\begin{tabular}{c c c} \hline \hline
**Model** & **Mean F1-Score (\%)** & **Std. Dev.** \\ \hline MLP & 91.00 & \(\pm 0.14\) \\ \hline RF & 93.00 & \(\pm 0.14\) \\ \hline XGBost & 98.02 & \(\pm 0.13\) \\ \hline LogRESP-Agent + RF & 98.25 & \(\pm 0.12\) \\ \hline LogRESP-Agent + XGB & 98.96 & \(\pm 0.10\) \\ \hline \hline \end{tabular}
\end{table} 
Table 9: [PERSON]’s \(t\)-test. Mean F1-score and standard deviation for multi-class classification (EVTX-ATTACK-SAMPLES dataset). To validate the context further, the agent employs _ContextRetriever_, which reconstructs the execution hierarchy and confirms that the Chrome process was launched by Slack--an expected behavior in enterprise environments. No anomalous flags or privilege escalation attempts were observed. _\"No malicious patterns were detected. The execution chain matches typical Chrome browser behavior.\"_

This case highlights LogRESP-Agent's ability to avoid false positives by combining rule-based detection, anomaly scoring, and contextual correlation. The resulting explanation is both accurate and interpretable, demonstrating the agent's effectiveness in identifying benign activity with high precision. **(2)** **Case 2.