# LogRESP-Agent: A Recursive AI Framework for Context-Aware Log Anomaly Detection and TTP Analysis
## 3 Proposed Method
### Recursive Reasoning Framework for Log Analysis
We acknowledge that several recent models--particularly those employing generative or meta-reasoning techniques such as Reflexion and AgentBench--have introduced innovative directions in agent-based analysis. However, many of these approaches have been developed primarily for general-purpose tasks and are not yet readily applicable to log anomaly detection in complex, heterogeneous security environments. In addition, reproducible implementations or compatible datasets for these frameworks are currently limited in the cybersecurity domain. For this reason, we focused on models with established applicability to log data, while considering broader agent-based comparisons as an important avenue for future work. ### Detection Performance Evaluation

#### 4.3.1 Anomaly Detection Performance on Monster-THC Dataset

We evaluated the anomaly detection capabilities of LogRESP-Agent against two strong baselines--Autoencoder and LogBERT--across three process categories: Chrome, Edge, and Hwp. Evaluation metrics include True Positive Rate (TPR), False Positive Rate (FPR), Accuracy, and F1-score, where high TPR, Accuracy, and F1 combined with low FPR indicate robust detection performance. As shown in Table 6, LogRESP-Agent consistently outperforms both baselines. Averaged across all processes, it achieved TPR 0.94, FPR 0.0, and F1-score 0.97--improving F1 by 15 percentage points over Autoencoder and 14 points over LogBERT. Notably, while LogBERT exhibited high accuracy, it frequently missed anomalies, as shown by its lower recall and F1. Key findings include the following:

* **Chrome logs**: LogRESP-Agent achieved full recall (TPR = 1.0, F1 = 1.0) with zero false positives, whereas LogBERT and Autoencoder recorded significantly lower F1-scores (0.81 and 0.73, respectively). * **Edge logs**: The agent maintained strong performance (F1 = 0.94, TPR = 0.88), outperforming both baselines, which had comparable F1-scores (0.86) but lower recall. \begin{table}
\begin{tabular}{c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Process**} & \multicolumn{4}{c}{**Autoencoder**} & \multicolumn{4}{c}{**LogBERT**} & \multicolumn{4}{c}{**LogRESP-Agent (Proposed)**} \\ \cline{2-13}  & TPR & FPR & Acc & F1 & TPR & FPR & Acc & F1 & TPR & FPR & Acc & F1 \\ \hline Chrome & 0.79 & 0.002 & 0.99 & 0.73 & 0.71 & 0.0002 & 0.99 & 0.81 & 1.0 & 0.0 & 1.0 & 1.0 \\ \hline Edge & 0.78 & 0.002 & 0.98 & 0.86 & 0.75 & 0.0 & 0.98 & 0.86 & 0.88 & 0.0 & 0.99 & 0.94 \\ \hline Hwp & 0.78 & 0.002 & 0.99 & 0.86 & 0.68 & 0.0005 & 0.99 & 0.81 & 0.94 & 0.0 & 0.99 & 0.97 \\ \hline All & 0.78 & 0.0002 & 0.98 & 0.82 & 0.71 & 0.0002 & 0.99 & 0.83 & 0.94 & 0.0 & 0.99 & 0.97 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Anomaly Detection performance of LogRESP-Agent compared with baseline models on the Monster-THC datasets. * **Hwp**: On this more diverse process type, LogRESP-Agent again led with TPR 0.94 and F1-score 0.97, while LogBERT underperformed (TPR 0.68, F1 0.81), and Autoencoder plateaued at F1 0.86. These results show that the agent not only inherits LogBERT's semantic understanding but further enhances detection accuracy through recursive reasoning and multi-tool integration. Tools like _RuleMatcher_ and _DescriptionGenerator_ contribute contextual insights that help reduce false alarms and detect subtle anomalies--boosting the system's practical utility in resource-constrained environments. To further validate these performance improvements, we conducted a [PERSON]'s \(t\)-test using five independent runs for each model. As shown in Table 7, LogRESP-Agent achieved an average F1-score of 97.37% (\(\pm\)0.57), outperforming LogBERT (83.52% \(\pm\) 0.99) and Autoencoder (80.96% \(\pm\) 1.10) on the anomaly detection task. The resulting \(p\)-values were 7.59 \(\times\) 10\({}^{-8}\) (vs. LogBERT) and 1.05 \(\times\) 10\({}^{-7}\) (vs. Autoencoder), both well below the 0.001 threshold. These results suggest that the observed performance gains of LogRESP-Agent are statistically significant and unlikely to result from random variation.