human: Given a hyperedge-centered hypergraph: <hypergraph>, where the center hyperedge is induced by one source paper and its member nodes are the cited papers.

Details of the hypergraph:
Center hyperedge (induced by source paper "learning fast and slow propedeutica for real time malware detection"):
  Abstract: In this paper, we introduce and evaluate PROPEDEUTICA, a novel methodology and framework for efficient and effective real-time malware detection, leveraging the best of conventional machine learning (ML) and deep learning (DL) algorithms. In PROPEDEUTICA, all software processes in the system start execution subjected to a conventional ML detector for fast classification. If a piece of software receives a borderline classification, it is subjected to further analysis via more performance expensive and more accurate DL methods, via our newly proposed DL algorithm DEEPMALWARE. Further, we introduce delays to the execution of software subjected to deep learning analysis as a way to "buy time" for DL analysis and to rate-limit the impact of possible malware in the system. We evaluated PROPEDEUTICA with a set of 9,115 malware samples and 877 commonly used benign software samples from various categories for the Windows OS. Our results show that the false positive rate for conventional ML methods can reach 20%, and for modern DL methods it is usually below 6%. However, the classification time for DL can be 100X longer than conventional ML methods. PROPEDEUTICA improved the detection F1-score from 77.54% (conventional ML method) to 90.25%, and reduced the detection time by 54.86%. Further, the percentage of software subjected to DL analysis was approximately 40% on average. Further, the application of delays in software subjected to ML reduced the detection time by approximately 10%. Finally, we found and discussed a discrepancy between the detection accuracy offline (analysis after all traces are collected) and on-the-fly (analysis in tandem with trace collection). Our insights show that conventional ML and modern DL-based malware detectors in isolation cannot meet the needs of efficient and effective malware detection: high accuracy, low false positive rate, and short classification time.

Includes members:
  Member "when coding style survives compilation de anonymizing programmers from executable binaries":
    also connected through other hyperedges:
      - Hyperedge HE-1 (induced by source paper "parallelizing binary code analysis")
  Member "mean birds detecting aggression and bullying on twitter":
    also connected through other hyperedges:
      - Hyperedge HE-2 (induced by source paper "angry birds flock together aggression propagation on social media")
  Member "adversarial perturbations against deep neural networks for malware classification":
    also connected through other hyperedges:
      - Hyperedge HE-3 (induced by source paper "on the security of randomized defenses against adversarial samples")
  Member "mamadroid detecting android malware by building markov chains of behavioral models":
    also connected through other hyperedges:
      - Hyperedge HE-4 (induced by source paper "hidden in plain sight obfuscated strings threatening your privacy")
  Member "xgboost a scalable tree boosting system":
    also connected through other hyperedges:
      - Hyperedge HE-5 (induced by source paper "monotonic cardinality estimation of similarity selection a deep learning approach")
  Member "towards evaluating the robustness of neural networks":
    also connected through other hyperedges:
      - Hyperedge HE-6 (induced by source paper "adversarial ranking attack and defense")
  Member "applying bag of system calls for anomalous behavior detection of applications in linux containers":
    also connected through other hyperedges:
      - Hyperedge HE-7 (induced by source paper "toward smart moving target defense for linux container resiliency")
  Member "deep neural network based malware detection using two dimensional binary program features":
    also connected through other hyperedges:
      - Hyperedge HE-8 (induced by source paper "automatic generation of adversarial examples for interpreting malware classifiers")

Question: Please tell me which class the source paper belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CR(Cryptography and Security)