# LogRESP-Agent: A Recursive AI Framework for Context-Aware Log Anomaly Detection and TTP Analysis
## 3 Proposed Method
### Recursive Reasoning Framework for Log Analysis
The term expected_gain\(\big{(}T_{j},\ O_{1:t-1}\big{)}\) quantifies the likelihood that applying the tool \(T_{j}\) will yield novel insights, given prior observations; for instance, when a rule match is inconclusive, _ContextRetriever_ may provide additional context by expanding the investigative scope. Both components are scored on a 5-point scale and evaluated directly by the LLM through contextual reasoning rather than fixed mathematical functions. The LLM interprets each tool's description, relevant metadata (e.g., goal categories, keyword associations), and the current state to assign these scores. This allows flexible yet interpretable decision-making, without relying on rigid rule sequences or predefined numerical formulas. For example, if the agent aims to determine whether a log entry is anomalous, it first evaluates candidate tools by scoring their relevance to the goal and expected information gain. Based on this utility estimation, _SequenceScore_ may receive the highest combined score due to its strong alignment with behavioral assessment. The agent then executes _SequenceScore_ to evaluate the likelihood of anomalous behavior. If an anomaly is detected, the agent again scores remaining tools in the new context, often assigning high utility to _RuleMatcher_ to identify rule-based explanations. Should no rule match occur, the LLM may assign a lower expected gain to further rule-based tools and instead prioritize _ContextRetriever_ for its potential to expand investigative context. While the current mechanism is heuristic in nature, it provides a practical and extensible foundation for dynamic tool selection. Future work will explore replacing the LLM-assigned utility scores with trainable, data-driven models to further enhance adaptivity and theoretical grounding. ### Context-Aware Execution

The selected tool is invoked to analyze the event or retrieve additional context. Tools may include _RuleMatcher_, _DescriptionGenerator_, _TTPMapper_, or _ContextRetriever_. The resulting insight \(r_{t}\) is stored in the agent's short-term memory, forming the basis for further reasoning. Detailed descriptions of each tool are provided in Section 3.2. ### Reasoning via Recursive Threat Interpretation

In the final stage, the agent evaluates whether the current evidence is sufficient to draw a conclusion about the given analysis goal. If uncertainty remains, it returns to the Planning stage to reassess and continue the investigation. This forms a recursive loop of hypothesis generation, tool invocation, and result interpretation--formally described as the Thought-Action-Observation (TAO) cycle. To support this iterative reasoning, the agent maintains two memory structures. A short-term memory stores observations and tool outputs from the current session to inform immediate decisions. A global reasoning trace records the full sequence of thoughts, actions, and results, which are synthesized when generating the final explanation. Reasoning for termination is ruled by a confidence-based decision policy, as follows:

\[terminate=\left\{ \begin{array}{cl}1,&if\;\;confidence_{malicious}(O)\geq\theta_{1} \;\;\;or\;\;confidence_{benign}(O)\geq\theta_{2}\\ 0,&\;\;otherwise\end{array} \right. \tag{2}\]

The agent stops reasoning when there is sufficient evidence to support either a malicious or benign classification with high confidence. This recursive reasoning framework supports the following several key capabilities:

* **Autonomous Planning**: The agent independently determines which tools to invoke and in what order. * **Dynamic Context Expansion**: Relevant external information is retrieved as needed to fill knowledge gaps. * **Recursive Hypothesis Refinement**: Each cycle incorporates new observations to update and improve its hypothesis. * **Goal-Directed Reasoning**: All steps are explicitly tied to the initial analysis objective, ensuring coherence.