human: Given a hyperedge-centered hypergraph: <hypergraph>, where the center hyperedge is induced by one source paper and its member nodes are the cited papers.

Details of the hypergraph:
Center hyperedge (induced by source paper "poirot aligning attack behavior with kernel audit records for cyber threat hunting"):
  Abstract: Cyber threat intelligence (CTI) is being used to search for indicators of attacks that might have compromised an enterprise network for a long time without being discovered. To have a more effective analysis, CTI open standards have incorporated descriptive relationships showing how the indicators or observables are related to each other. However, these relationships are either completely overlooked in information gathering or not used for threat hunting. In this paper, we propose a system, called POIROT, which uses these correlations to uncover the steps of a successful attack campaign. We use kernel audits as a reliable source that covers all causal relations and information flows among system entities and model threat hunting as an inexact graph pattern matching problem. Our technical approach is based on a novel similarity metric which assesses an alignment between a query graph constructed out of CTI correlations and a provenance graph constructed out of kernel audit log records. We evaluate POIROT on publicly released real-world incident reports as well as reports of an adversarial engagement designed by DARPA, including ten distinct attack campaigns against different OS platforms such as Linux, FreeBSD, and Windows. Our evaluation results show that POIROT is capable of searching inside graphs containing millions of nodes and pinpoint the attacks in a few minutes, and the results serve to illustrate that CTI correlations could be used as robust and reliable artifacts for threat hunting.

Includes members:
  Member "runtime analysis of whole system provenance":
    also connected through other hyperedges:
      - Hyperedge HE-1 (induced by source paper "unicorn runtime provenance based detector for advanced persistent threats")
  Member "holmes real time apt detection through correlation of suspicious information flows":
    also connected through other hyperedges:
      - Hyperedge HE-2 (induced by source paper "unicorn runtime provenance based detector for advanced persistent threats")
  Member "propatrol attack investigation via extracted high level tasks":
    also connected through other hyperedges:
      (none)
  Member "sleuth real time attack scenario reconstruction from cots audit data":
    also connected through other hyperedges:
      - Hyperedge HE-3 (induced by source paper "unicorn runtime provenance based detector for advanced persistent threats")
  Member "saql a stream based query system for real time abnormal system behavior detection":
    also connected through other hyperedges:
      - Hyperedge HE-4 (induced by source paper "unicorn runtime provenance based detector for advanced persistent threats")
  Member "aiql enabling efficient attack investigation from system monitoring data":
    also connected through other hyperedges:
      - Hyperedge HE-5 (induced by source paper "querying streaming system monitoring data for enterprise system anomaly detection")
  Member "behavior query discovery in system generated temporal graphs":
    also connected through other hyperedges:
      (none)
  Member "detection of early stage enterprise infection by mining large scale log data":
    also connected through other hyperedges:
      - Hyperedge HE-6 (induced by source paper "attacking graph based classification via manipulating the graph structure")

Question: Please tell me which class the source paper belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CR(Cryptography and Security)