# LogRESP-Agent: A Recursive AI Framework for Context-Aware Log Anomaly Detection and TTP Analysis
## 3 Proposed Method
### Recursive Reasoning Framework for Log Analysis
Its recursive TAO reasoning loop, flexible tool extensibility, and output-level explainability establish it as a highly adaptive and analyst-friendly solution. A key contribution of this work lies in demonstrating how recursive reasoning and modular tool orchestration can bridge the gap between static detection and real-world investigative workflows. By generating human-readable explanations aligned with MITRE ATT&CK and contextual process traces, LogRESP-Agent enhances both accuracy and actionability in modern SOC environments. In future work, we aim to expand LogRESP-Agent along three key directions. First, we plan to develop a format-agnostic log normalization module to support consistent interpretation across diverse log schemas, enhancing interoperability with EDR, SIEM, and cloud-native sources. Second, we will investigate integration with automated response systems to support real-time mitigation workflows--such as generating firewall rules or isolating compromised hosts. Lastly, we intend to evaluate the agent's robustness under adversarial conditions by simulating log manipulation attacks and extending the reasoning framework to detect evasive behaviors. **Author Contributions:** Conceptualization, J.L. and Y.J. ; methodology, J.L., Y.J. and T.H. ; software, J.L. and Y.J. ; validation, J.L., Y.J. and T.H. ; formal analysis, J.L. and Y.J. ; investigation, [PERSON] and Y.J. ; resources, [PERSON], Y.J. and T.L. ; data curation, J.L. ; writing--original draft preparation, [PERSON] and Y.J. ; writing--reviewing and editing, [PERSON], Y.J., T.H. and T.L. ; visualization, J.L. ; supervision, T.L. ; project administration, T.L. ; funding acquisition, T.L. All authors have read and agreed to the published version of the manuscript. This work was funded by the Institute of Information & Communications Technology Planning & Evaluation (IITP) grant from the Ministry of Science and ICT (MSIT) under Grant No. RS-2023-00235509, \"Development of security monitoring technology based on network behavior against encrypted cyber threats in ICT convergence environment\" (70%), and Grant No. RS-2024-00354169, \"Technology Development of Threat Model/XAI-based Network Abnormality Detection, Response and Cyber Threat Prediction\" (30%). Not applicable. This study analyzed both public and private datasets. The EVTX-ATTACK-SAMPLES dataset is openly available on GitHub (commit 4 ceed2f, last updated on 24 January 2023) [42]. However, the Monster-THC dataset is not publicly available due to privacy and contractual restrictions, as it was provided by an industrial partner. Data sharing is subject to the provider's approval and cannot be disclosed without prior authorization. Requests to access this dataset should be directed to the corresponding author. The authors declare no conflicts of interest. ## References

* 1 [PERSON] Machine Learning and AI in Endpoint Security: Analyzing the use of AI and machine learning algorithms for anomaly detection and threat prediction in endpoint security. _J. Sci. Eng. Res._**2021**, \(8\), 264-270. * 2 [PERSON]; [PERSON] An empirical assessment of endpoint detection and response systems against advanced persistent threats attack vectors. _J. Cybersecur. Priv._**2021**, \(1\), 387-421. [CrossRef]
* 3 [PERSON] Read the digital fingerprints: Log analysis for digital forensics and security. _Comput. Fraud. Secur._**2021**, _2021_, 11-16. [CrossRef]
* 4 [PERSON]; [PERSON]; [PERSON] Detecting lateral movement: A systematic survey. _Heliyon_**2024**, _10_, e26317. [CrossRef]
* 5 [PERSON]; [PERSON] A framework for constructing features and models for intrusion detection systems. _ACM Trans. Inf. Syst. Secur._**2000**, \(3\), 227-261. [CrossRef]
* 6 [PERSON]; [PERSON]; [PERSON] Intrusion detection using sequences of system calls. _J. Comput. Secur._**1998**, \(6\), 151-180. [CrossRef]
* 7 [PERSON]; [PERSON] Anomaly detection in log files based on machine learning techniques. _J. Electr. Syst._**2024**, _20_, 1299-1311.