human: Given a node-centered hypergraph: <hypergraph>, where nodes represent papers and hyperedges represent sets of papers co-cited by a source paper.

Details of the hypergraph:
Center node: "automated behavioral analysis of malware a case study of wannacry ransomware"
  Abstract: Ransomware, a class of self-propagating malware that uses encryption to hold the victims' data ransom, has emerged in recent years as one of the most dangerous cyber threats, with widespread damage; e.g., zero-day ransomware WannaCry has caused world-wide catastrophe, from knocking U.K. National Health Service hospitals offline to shutting down a Honda Motor Company in Japan[1]. Our close collaboration with security operations of large enterprises reveals that defense against ransomware relies on tedious analysis from high-volume systems logs of the first few infections. Sandbox analysis of freshly captured malware is also commonplace in operation. #R##N#We introduce a method to identify and rank the most discriminating ransomware features from a set of ambient (non-attack) system logs and at least one log stream containing both ambient and ransomware behavior. These ranked features reveal a set of malware actions that are produced automatically from system logs, and can help automate tedious manual analysis. We test our approach using WannaCry and two polymorphic samples by producing logs with Cuckoo Sandbox during both ambient, and ambient plus ransomware executions. Our goal is to extract the features of the malware from the logs with only knowledge that malware was present. We compare outputs with a detailed analysis of WannaCry allowing validation of the algorithm's feature extraction and provide analysis of the method's robustness to variations of input data\textemdash changing quality/quantity of ambient data and testing polymorphic ransomware. Most notably, our patterns are accurate and unwavering when generated from polymorphic WannaCry copies, on which 63 (of 63 tested) anti-virus (AV) products fail.

Connected through hyperedge HE-1 (induced by source paper "ransomware analysis using feature engineering and deep neural networks"):
  with members:
    - "a recent survey on the applications of genetic programming in image processing"
    - "a survey of the recent architectures of deep convolutional neural networks"
    - "a new channel boosted convolution neural network using transfer learning"
    - "software defined networking based crypto ransomware detection using http traffic characteristics"
    - "automated dynamic analysis of ransomware benefits limitations and use for detection"
    - "deep neural network based malware detection using two dimensional binary program features"
    - "deep residual learning for image recognition"

Connected through hyperedge HE-2 (induced by source paper "automated ransomware behavior analysis pattern extraction and early detection"):
  with members:
    - "credit default mining using combined machine learning and heuristic approach"
    - "how do information security workers use host data a summary of interviews with security analysts"
    - "know abnormal find evil frequent pattern mining for ransomware threat hunting and intelligence"

Connected through hyperedge HE-3 (induced by source paper "key ssd access control drive to protect files from ransomware attacks"):
  with members:
    - "a survey of stealth malware attacks mitigation measures and steps toward autonomous open world solutions"
    - "using software defined networking for ransomware mitigation the case of cryptowall"

Connected through hyperedge HE-4 (induced by source paper "a survey of intrusion detection systems leveraging host data"):
  with members:
    - "setting the threshold for high throughput detectors a mathematical approach for ensembles of dynamic heterogeneous probabilistic anomaly detectors"
    - "malware detection on general purpose computers using power consumption monitoring a proof of concept and case study"
    - "identifying ecus using inimitable characteristics of signals in controller area networks"
    - "graphprints towards a graph analytic method for network anomaly detection"

Connected through hyperedge HE-5 (induced by source paper "forming ideas interactive data exploration analysis system"):
  with members:
    - "setting the threshold for high throughput detectors a mathematical approach for ensembles of dynamic heterogeneous probabilistic anomaly detectors"

Connected through hyperedge HE-6 (induced by source paper "how do information security workers use host data a summary of interviews with security analysts"):
  with members:
    - "forming ideas interactive data exploration analysis system"

Question: Please tell me which class the center node belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CR(Cryptography and Security)