# LogRESP-Agent: A Recursive AI Framework for Context-Aware Log Anomaly Detection and TTP Analysis
## 3 Proposed Method
### Recursive Reasoning Framework for Log Analysis
### AI Agent Architecture

The proposed agent is built on a modular reasoning framework coordinated by the Gemini-2.0-Flash large language model (LLM). The LLM orchestrates seven specialized tools to support semantic interpretation, anomaly scoring, rule-based matching, and threat mapping. Each tool is invoked dynamically based on the current reasoning context. A detailed overview of these tools, including their roles, functions, and output formats, is provided in Table 5 (see end of manuscript). Unlike static pipelines, the agent performs recursive reasoning--selecting tools and interpreting results in context. Its flexible workflow enables multi-step analysis that adapts to intermediate findings. ### Baseline Methods

To ensure a comprehensive evaluation, we compared the AI Agent to three categories of baseline models, as follows:

1. **Unsupervised anomaly detection models. ** We included an Autoencoder and LogBERT as representative unsupervised methods. The Autoencoder detects anomalies based on reconstruction error, while LogBERT leverages masked language modeling to identify sequence-level deviations in system logs. 2. **Supervised machine learning classifiers. ** For multi-class classification, we trained standard classifiers including MLP, Random Forest, and XGBoost using structured log features. These models were selected for their widespread use in intrusion detection tasks and their strong performance on tabular data. 3. **Agent-based ensemble variants. ** In addition to standalone models, we evaluated two configurations of the proposed AI Agent: one using LogBERT for binary anomaly detection, and the other using either Random Forest or XGBoost for multi-class classification. These variants retain the same modular reasoning structure, with only the scoring component replaced. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Tool Name** & **Role in Reasoning Loop** & **Function** & **Output Format** \\ \hline LogLoader & Data ingestion & Standardizes input logs into a unified format for downstream processing & Structured log in standard format \\ \hline RuleMather & Signature-based detection (early stage) & Applies YARA/Sigma/custom rules to detect known suspicious patterns in process logs & Match result, rule metadata \\ \hline Description & Semantic summarization & Generates natural language summaries by pairing key log features with values to support semantic reasoning & Natural language sentence \\ \hline SequenceScorer & Behavior modeling & Computes anomaly scores using LogBERT (anomaly detection) or classifies using RF/XGBoost (multi-class) & Score (0–1) or class label \\ \hline ContextRetriever & Context expansion & Gathers related events (parent/child processes) to support behavioral correlation. & Related logs information (dict) \\ \hline TTPMapper & Threat behavior mapping & Maps log behavior to MITRE ATT\&CK techniques via cosine similarity between log descriptions and TTP embeddings & Mapped TTP ID and label, Description \\  & & (MiniLM-L12-v2). & \\ \hline ThreatLookup & Intelligence enrichment & Provides concise descriptions of known TPs and malware for enriched interpretation. & Textual threat summary \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Tools Integrated in the AI Security Agent Architecture. By evaluating across these configurations, we aim to assess not only classification accuracy but also the interpretability and flexibility of the agent's recursive reasoning process. These baseline models were selected to reflect representative and widely adopted approaches in log anomaly detection, balancing practical applicability with methodological diversity. Autoencoder, MLP, and Random Forest represent foundational models from early anomaly detection research. XGBoost was included for its high effectiveness in multi-class classification, and LogBERT was selected as a Transformer-based baseline with publicly available code and consistent benchmark results.