# LogRESP-Agent: A Recursive AI Framework for Context-Aware Log Anomaly Detection and TTP Analysis
## 3 Proposed Method
### Recursive Reasoning Framework for Log Analysis
In this study, we focused on demonstrating the agent's reasoning process and behavioral alignment using representative qualitative examples. While structured human evaluations (e.g., fidelity or sufficiency scoring) remain important, they are left for future work as part of a broader deployment and user feedback phase. ### Ablation Study on Tool-Level Contributions to Detection Accuracy

To assess the contribution of individual modules, we conducted a limited ablation study by selectively turning off each internal tool and measuring the resulting impact on F1-score in anomaly detection as well as in multi-class classification using LogRESP-Agent with LogBERT, random forest, and XGBoost backends. As shown in Table 10, removing the _RuleMatcher_ led to the largest average performance drop (4.01%), followed by _TTPMapper_ (3.50%) and _SequenceScorer_ (2.71%). The removal of _ThreatLookup_ had the least impact (1.22%). These results suggest that while each component contributes to overall performance, tools such as _RuleMatcher_ and _TTPMapper_ appear to play particularly influential roles in both detection accuracy and classification fidelity. Figure 5: Reasoning trace and final output of LogRESP-Agent for attack Windows Event log entry (#441). ## 5 Discussion

This section discusses the practical implications, comparative advantages, and current limitations of the proposed LogRESP-Agent framework, as well as potential directions for future work. ### (1) Practical Value and Comparative Advantages

LogRESP-Agent offers high detection accuracy and interpretability without relying on structured input formats or fixed templates, making it well-suited for deployment in real-world, heterogeneous log environments. Its integration of semantic reasoning and TTP-based explanations enables Security Operations Centers (SOCs) to reduce triage time and improve incident response quality by delivering clear, actionable insights. In comparison to traditional models such as Autoencoders and LogBERT, LogRESP-Agent achieves superior performance while preserving transparency. Unlike static prompt-based agents (e.g., IDS-Agent or Wazuh-SERC), it utilizes a dynamic Thought-Action-Observation cycle that supports adaptive reasoning and context-aware decision-making, offering a more flexible and intelligent analysis capability. The system is designed for long-term adaptability through model-independent updates and modular tool maintenance. In typical use cases, retraining is not required for unsupervised models (e.g., Autoencoder, LogBERT), as they detect anomalies based on deviations from previously observed normal behavior. However, if the underlying data distribution significantly shifts, retraining may be considered to preserve detection accuracy. Additionally, tools such as _RuleMatcher_, _ContextRetriever_, _TTPMapper_, and _ThreatLookup_ are independently maintainable, allowing new threat patterns to be incorporated without directly modifying the core AI model. This modular architecture facilitates ongoing system evolution while minimizing operational overhead, thereby enhancing the practical utility of LogRESP-Agent in dynamic threat environments. Under the current configuration, LogRESP-Agent requires approximately 10-15 s per log entry to complete its full reasoning cycle, with individual tool invocations typically completing within 1 to 5 s. This processing time is appropriate for investigative and triage scenarios where interpretability and contextual depth are prioritized over real-time throughput. By leveraging external API-based LLM access, the framework imposes minimal local memory overhead, supporting lightweight deployment within existing SOC infrastructures. ### (2) Current Limitations and Future Directions

Despite its strengths, LogRESP-Agent currently focuses on detection and explanation rather than direct automated response (e.g., generating firewall rules or isolating compromised hosts). Its accuracy and reliability are inherently dependent on the effectiveness of