# LogRESP-Agent: A Recursive AI Framework for Context-Aware Log Anomaly Detection and TTP Analysis
## 3 Proposed Method
### Recursive Reasoning Framework for Log Analysis
Figure 2 illustrates the recursive TAO cycle described above, summarizing how LogRESP-Agent executes log analysis through sequential planning, execution, and reasoning steps. Each cycle involves the dynamic invocation of appropriate tools--such as _SequenceScorer_ or _ContextRetriever_--based on the agent's evolving hypothesis. These tools provide diverse types of evidence, which are integrated and assessed until the agent reaches a confident conclusion. This design supports multi-step, context-aware reasoning across semi-structured and incomplete logs. ### Tool-Oriented Semantic Transformation and Anomaly Detection

To support goal-directed log interpretation, the proposed agent integrates a suite of modular tools, each performing a distinct analytical role. These tools are not arranged in a fixed pipeline; instead, they are dynamically orchestrated by the LLM planner during each Thought-Action-Observation (TAO) cycle. At every reasoning step, the agent selects and invokes only the tools most relevant to the current hypothesis and available context. A summary of the tools and their corresponding functions is provided in Table 2.

Each invocation yields an observation appended to the agent's short-term memory and used in subsequent reasoning. Tools are revisited or bypassed adaptively; for example, the agent may switch from _RuleMatcher_ to _ContextRetriever_ when no known rule matches are found, then revisit the rule matching after additional context is retrieved. \begin{table}
\begin{tabular}{c c} \hline \hline
**Tool** & **Function** \\ \hline LogLoader & Structures raw log data from system or endpoint sources for further analysis \\ \hline RuleMatcher & Applies rules to identify known malicious signatures \\ \hline DescriptionGenerator & Converts structured logs into natural language event summaries \\ \hline SequenceScorer & Scores log sequences based on behavioral anomalies using pretrained models \\ \hline ContextRetriever & Gathers related process logs (e.g., parent/child) to support correlation \\ \hline TTPMapper & Maps observed behaviors to MITRE ATT\&CK TTPs \\ \hline ThreatLookup & Fetches background information on threats or attacker tools from threat intel \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Summary of Tools Used for Semantic Transformation and Threat Inference. This modular tool integration enables multi-perspective reasoning, where each tool contributes a complementary semantic or structural insight. Embedded within the recursive TAO framework, this architecture allows the agent to adaptively construct threat narratives, offering interpretable and context-rich explanations for both known and novel attack patterns. ### Dynamic Analysis Cycle and Final Reasoning Output

Following iterative evidence collection via recursive reasoning, the agent proceeds to a final decision-making phase, where it synthesizes observations into a coherent explanation aligned with the original analysis goal. Unlike static anomaly detection systems that output binary labels or numerical scores, our agent adaptively revises its reasoning path based on evolving evidence and tool outputs. Each TAO (Thought-Action-Observation) cycle is context-aware and hypothesis-driven. For example, if a rule match fails to yield results, the agent dynamically pivots to anomaly scoring or contextual retrieval. Conversely, the presence of multiple corroborating signals--such as elevated anomaly scores, matched TTPs, and relevant process ancestry--triggers early convergence toward a threat hypothesis. Reasoning concludes when the agent determines that sufficient evidence has accumulated to justify a final decision. This decision is based on the semantic convergence of multiple signals, not a single heuristic. To illustrate how the agent adapts to different investigation outcomes, Table 3 summarizes typical reasoning paths. The final explanation output is designed to be human-interpretable and operationally useful, and typically contains the following:

1.