LogRESP-Agent: A Recursive AI Framework for Context-Aware Log Anomaly Detection and TTP Analysis
Source abstract
Abstract
As cyber threats become increasingly sophisticated, existing log-based anomaly detection models face critical limitations in adaptability, semantic interpretation, and operational automation. Traditional approaches based on CNNs, RNNs, and LSTMs struggle with inconsistent log formats and often lack interpretability. To address these challenges, we propose LogRESP-Agent, a modular AI framework built around a reasoning-based agent for log-driven security prediction and response. The architecture integrates three core capabilities, including (1) LLM-based anomaly detection with semantic explanation, (2) contextual threat reasoning via Retrieval-Augmented Generation (RAG), and (3) recursive investigation capabilities enabled by a planning-capable LLM agent. This architecture supports automated, multi-step analysis over heterogeneous logs without reliance on fixed templates. Experimental results validate the effectiveness of our approach on both binary and multi-class classification tasks. On the Monster-THC dataset, LogRESP-Agent achieved 99.97% accuracy and 97.00% F1-score, while also attaining 99.54% accuracy and 99.47% F1-score in multi-class classification using the EVTX-ATTACK-SAMPLES dataset. These results confirm the agent’s ability to not only detect complex threats but also explain them in context, offering a scalable foundation for next-generation threat detection and response automation.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Software System Performance and Reliability · Network Security and Intrusion Detection · Anomaly Detection Techniques and Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Information Security, Gachon University, Seongnam 13120, Republic of Korea
Funding
the Institute of Information & Communications Technology Planning & Evaluation (IITP) grant from the Ministry of Science and ICT (MSIT) · “Development of security monitoring technology based on network behavior against encrypted cyber threats in ICT convergence environment”
References (42)
Show source-provided references
1. Machine Learning and AI in Endpoint Security: Analyzing the use of AI and machine learning algorithms for anomaly detection and threat prediction in endpoint security
2. An empirical assessment of endpoint detection and response systems against advanced persistent threats attack vectors10.3390/jcp1030021 ↗
3. Read the digital fingerprints: Log analysis for digital forensics and security10.1016/S1361-3723(21)00074-9 ↗
4. Detecting lateral movement: A systematic survey10.1016/j.heliyon.2024.e26317 ↗
5. A framework for constructing features and models for intrusion detection systems10.1145/382912.382914 ↗
6. Intrusion detection using sequences of system calls10.3233/JCS-980109 ↗
7. Anomaly detection in log files based on machine learning techniques10.52783/jes.1505 ↗
8. Anomaly detection in log-event sequences: A federated deep learning approach and open challenges
9. LightLog: A lightweight temporal convolutional network for log anomaly detection on the edge10.1016/j.comnet.2021.108616 ↗
10. Lu, S., Wei, X., Li, Y., and Wang, L. (2018, January 12–15). Detecting anomaly in big data system logs using convolutional neural network. Proceedings of the 2018 IEEE 16th Intl Conf on Dependable, Autonomic and Secure Computing, 16th Intl Conf on Pervasive Intelligence and Computing, 4th Intl Conf on Big Data Intelligence and Computing and Cyber Science and Technology Congress (DASC/PiCom/DataCom/CyberSciTech), Athens, Greece.10.1109/DASC/PiCom/DataCom/CyberSciTec.2018.00037 ↗
11. Meng, W., Liu, Y., Zhu, Y., Zhang, S., Pei, D., Liu, Y., Chen, Y., Zhang, R., Tao, S., and Sun, P. (2019, January 10–16). Loganomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs. Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence, Macao, China.10.24963/ijcai.2019/658 ↗
12. Zhang, X., Xu, Y., Lin, Q., Qiao, B., Zhang, H., Dang, Y., Xie, C., Yang, X., Cheng, Q., and Li, Z. (2019, January 26–30). Robust log-based anomaly detection on unstable log data. Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Tallinn, Estonia.10.1145/3338906.3338931 ↗
13. Gu, S., Chu, Y., Zhang, W., Liu, P., Yin, Q., and Li, Q. (2021, January 28–31). Research on system log anomaly detection combining two-way slice GRU and GA-attention mechanism. Proceedings of the 2021 4th International Conference on Artificial Intelligence and Big Data (ICAIBD), Chengdu, China.10.1109/ICAIBD51990.2021.9459087 ↗
14. Unsupervised log message anomaly detection10.1016/j.icte.2020.06.003 ↗
15. Du, M., Li, F., Zheng, G., and Srikumar, V. (November, January 30). Deeplog: Anomaly detection and diagnosis from system logs through deep learning. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Dallas, TX, USA.10.1145/3133956.3134015 ↗
16. Wan, Y., Liu, Y., Wang, D., and Wen, Y. (2021, January 11–14). Glad-paw: Graph-based log anomaly detection by position aware weighted graph attention network. Proceedings of the Pacific-Asia Conference on Knowledge Discovery and Data Mining, Delhi, India.10.1007/978-3-030-75762-5_6 ↗
17. Guo, H., Yuan, S., and Wu, X. (2021, January 18–22). Logbert: Log anomaly detection via bert. Proceedings of the 2021 International Joint Conference on Neural Networks (IJCNN), Shenzhen, China.10.1109/IJCNN52387.2021.9534113 ↗
18. Han, X., Yuan, S., and Trabelsi, M. (2023, January 15–18). Loggpt: Log anomaly detection via gpt. Proceedings of the 2023 IEEE International Conference on Big Data (BigData), Sorrento, Italy.10.1109/BigData59044.2023.10386543 ↗
19. LogFiT: Log anomaly detection using fine-tuned language models10.1109/TNSM.2024.3358730 ↗
20. Ma, X., Li, Y., Keung, J., Yu, X., Zou, H., Yang, Z., Sarro, F., and Barr, E.T. (2024). Practitioners’ Expectations on Log Anomaly Detection. arXiv.
21. Deep learning for time series anomaly detection: A survey
22. Zang, R., Guo, H., Yang, J., Liu, J., Li, Z., Zheng, T., Shi, X., Zheng, L., and Zhang, B. (2024). MLAD: A Unified Model for Multi-system Log Anomaly Detection. arXiv.
23. Yue, M. (2025). A Survey of Large Language Model Agents for Question Answering. arXiv.
24. Masterman, T., Besen, S., Sawtell, M., and Chao, A. (2024). The landscape of emerging ai agent architectures for reasoning, planning, and tool calling: A survey. arXiv.
25. Cemri, M., Pan, M.Z., Yang, S., Agrawal, L.A., Chopra, B., Tiwari, R., Keutzer, K., Parameswaran, A., Klein, D., and Ramchandran, K. (2025). Why Do Multi-Agent LLM Systems Fail?. arXiv.
26. Li, Y., Xiang, Z., Bastian, N.D., Song, D., and Li, B. (2024). IDS-Agent: An LLM Agent for Explainable Intrusion Detection in IoT Networks. NeurIPS 2024 Workshop on Open-World Agents, Available online: https://openreview.net/forum?id=iiK0pRyLkw.
27. Enhancing Security Operations Center: Wazuh Security Event Response with Retrieval-Augmented-Generation-Driven Copilot10.3390/s25030870 ↗
28. Liang, Y., Zhang, Y., Xiong, H., and Sahoo, R. (2007, January 28–31). Failure prediction in ibm bluegene/l event logs. Proceedings of the Seventh IEEE International Conference on Data Mining (ICDM 2007), Omaha, Nebraska.10.1109/ICDM.2007.46 ↗
29. Wang, J., Tang, Y., He, S., Zhao, C., Sharma, P.K., Alfarraj, O., and Tolba, A. (2020). LogEvent2vec: LogEvent-to-vector based anomaly detection for large-scale logs in internet of things. Sensors, 20.10.3390/s20092451 ↗
30. Chen, M., Zheng, A.X., Lloyd, J., Jordan, M.I., and Brewer, E. (2004, January 17–18). Failure diagnosis using decision trees. Proceedings of the International Conference on Autonomic Computing, New York, NY, USA.
31. Dani, M.C., Doreau, H., and Alt, S. (2017;, January 27–30). K-means application for anomaly detection and log classification in hpc. Proceedings of the Advances in Artificial Intelligence: From Theory to Practice: 30th International Conference on Industrial Engineering and Other Applications of Applied Intelligent Systems, Arras, France.10.1007/978-3-319-60045-1_23 ↗
32. Mishra, A.K., Bagla, P., Sharma, R., Pandey, N.K., and Tripathi, N. (2023, January 27–29). Anomaly Detection from Web Log Data Using Machine Learning Model. Proceedings of the 2023 7th International Conference on Computer Applications in Electrical Engineering-Recent Advances (CERA), Roorkee, India.10.1109/CERA59325.2023.10455153 ↗
33. Karev, D., McCubbin, C., and Vaulin, R. (2017, January 23–24). Cyber threat hunting through the use of an isolation forest. Proceedings of the 18th International Conference on Computer Systems and Technologies, Ruse, Bulgaria.10.1145/3134302.3134319 ↗
34. Zhang, L., Cushing, R., de Laat, C., and Grosso, P. (2021, January 20–22). A real-time intrusion detection system based on OC-SVM for containerized applications. Proceedings of the 2021 IEEE 24th International Conference on Computational Science and Engineering (CSE), Shenyang, China.10.1109/CSE53436.2021.00029 ↗
35. Nonlinear principal component analysis using autoassociative neural networks10.1002/aic.690370209 ↗
36. Hitanomaly: Hierarchical transformers for anomaly detection in system log10.1109/TNSM.2020.3034647 ↗
37. Le, V.H., and Zhang, H. (2021, January 15–19). Log-based anomaly detection without log parsing. Proceedings of the 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE), Melbourne, Australia.10.1109/ASE51524.2021.9678773 ↗
38. Bert-log: Anomaly detection for system logs based on pre-trained language model10.1080/08839514.2022.2145642 ↗
39. Song, C., Ma, L., Zheng, J., Liao, J., Kuang, H., and Yang, L. (2024). Audit-LLM: Multi-Agent Collaboration for Log-based Insider Threat Detection. arXiv.
40. Reflexion: Language agents with verbal reinforcement learning
41. Liu, X., Yu, H., Zhang, H., Xu, Y., Lei, X., Lai, H., Gu, Y., Ding, H., Men, K., and Yang, K. (2023). Agentbench: Evaluating llms as agents. arXiv.
42. (2025, May 30). EVTX-ATTACK-SAMPLES. Available online: https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES.