human: Given a hyperedge-centered hypergraph: <hypergraph>, where the center hyperedge is induced by one source paper and its member nodes are the cited papers.

Details of the hypergraph:
Center hyperedge (induced by source paper "android hiv a study of repackaging malware for evading machine learning detection"):
  Abstract: Machine learning based solutions have been successfully employed for automatic detection of malware in Android applications. However, machine learning models are known to lack robustness against inputs crafted by an adversary. So far, the adversarial examples can only deceive Android malware detectors that rely on syntactic features, and the perturbations can only be implemented by simply modifying Android manifest. While recent Android malware detectors rely more on semantic features from Dalvik bytecode rather than manifest, existing attacking/defending methods are no longer effective. In this paper, we introduce a new highly-effective attack that generates adversarial examples of Android malware and evades being detected by the current models. To this end, we propose a method of applying optimal perturbations onto Android APK using a substitute model. Based on the transferability concept, the perturbations that successfully deceive the substitute model are likely to deceive the original models as well. We develop an automated tool to generate the adversarial examples without human intervention to apply the attacks. In contrast to existing works, the adversarial examples crafted by our method can also deceive recent machine learning based detectors that rely on semantic features such as control-flow-graph. The perturbations can also be implemented directly onto APK's Dalvik bytecode rather than Android manifest to evade from recent detectors. We evaluated the proposed manipulation methods for adversarial examples by using the same datasets that Drebin and MaMadroid (5879 malware samples) used. Our results show that, the malware detection rates decreased from 96% to 1% in MaMaDroid, and from 97% to 1% in Drebin, with just a small distortion generated by our adversarial examples manipulation method.

Includes members:
  Member "yes machine learning can be more secure a case study on android malware detection":
    also connected through other hyperedges:
      - Hyperedge HE-1 (induced by source paper "towards query efficient black box adversary with zeroth order natural gradient descent")
  Member "automated poisoning attacks and defenses in malware detection systems an adversarial machine learning approach":
    also connected through other hyperedges:
      - Hyperedge HE-2 (induced by source paper "unblind your apps predicting natural language labels for mobile gui components by deep learning")
  Member "generating adversarial malware examples for black box attacks based on gan":
    also connected through other hyperedges:
      - Hyperedge HE-3 (induced by source paper "automatic generation of adversarial examples for interpreting malware classifiers")
  Member "generic black box end to end attack against state of the art api call based malware classifiers":
    also connected through other hyperedges:
      - Hyperedge HE-4 (induced by source paper "automatic generation of adversarial examples for interpreting malware classifiers")
  Member "synthesizing robust adversarial examples":
    also connected through other hyperedges:
      - Hyperedge HE-5 (induced by source paper "adversarial ranking attack and defense")
  Member "adversarial examples for evaluating reading comprehension systems":
    also connected through other hyperedges:
      - Hyperedge HE-6 (induced by source paper "a study of the tasks and models in machine reading comprehension")
  Member "adversarial examples that fool detectors":
    also connected through other hyperedges:
      - Hyperedge HE-7 (induced by source paper "lower bounds on adversarial robustness from optimal transport")
  Member "adversarial examples attacks and defenses for deep learning":
    also connected through other hyperedges:
      - Hyperedge HE-8 (induced by source paper "varmixup exploiting the latent space for robust training and inference")

Question: Please tell me which class the source paper belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CR(Cryptography and Security)