human: Given a node-centered hypergraph: <hypergraph>, where nodes represent papers and hyperedges represent sets of papers co-cited by a source paper.

Details of the hypergraph:
Center node: "practical whole system provenance capture"
  Abstract: Data provenance describes how data came to be in its present form. It includes data sources and the transformations that have been applied to them. Data provenance has many uses, from forensics and security to aiding the reproducibility of scientific experiments. We present CamFlow, a whole-system provenance capture mechanism that integrates easily into a PaaS offering. While there have been several prior whole-system provenance systems that captured a comprehensive, systemic and ubiquitous record of a system's behavior, none have been widely adopted. They either A) impose too much overhead, B) are designed for long-outdated kernel releases and are hard to port to current systems, C) generate too much data, or D) are designed for a single system. CamFlow addresses these shortcoming by: 1) leveraging the latest kernel design advances to achieve efficiency; 2) using a self-contained, easily maintainable implementation relying on a Linux Security Module, NetFilter, and other existing kernel facilities; 3) providing a mechanism to tailor the captured provenance data to the needs of the application; and 4) making it easy to integrate provenance across distributed systems. The provenance we capture is streamed and consumed by tenant-built auditor applications. We illustrate the usability of our implementation by describing three such applications: demonstrating compliance with data regulations; performing fault/intrusion detection; and implementing data loss prevention. We also show how CamFlow can be leveraged to capture meaningful provenance without modifying existing applications.

Connected through hyperedge HE-1 (induced by source paper "unicorn runtime provenance based detector for advanced persistent threats"):
  with members:
    - "poirot aligning attack behavior with kernel audit records for cyber threat hunting"
    - "runtime analysis of whole system provenance"
    - "holmes real time apt detection through correlation of suspicious information flows"
    - "sleuth real time attack scenario reconstruction from cots audit data"
    - "saql a stream based query system for real time abnormal system behavior detection"
    - "how powerful are graph neural networks"
    - "benchmarking crimes an emerging threat in systems security"
    - "frappuccino fault detection through runtime analysis of provenance"

Connected through hyperedge HE-2 (induced by source paper "decision provenance harnessing data flow for accountable systems"):
  with members:
    - "datasheets for datasets"
    - "camflow managed data sharing for cloud services"
    - "frappuccino fault detection through runtime analysis of provenance"
    - "internet of things iot a vision architectural elements and future directions"

Connected through hyperedge HE-3 (induced by source paper "provmark a provenance expressiveness benchmarking system"):
  with members:
    - "runtime analysis of whole system provenance"
    - "camflow managed data sharing for cloud services"
    - "frappuccino fault detection through runtime analysis of provenance"

Connected through hyperedge HE-4 (induced by source paper "appmine behavioral analytics for web application vulnerability detection"):
  with members:
    - "runtime analysis of whole system provenance"
    - "process monitoring on sequences of system call count vectors"

Connected through hyperedge HE-5 (induced by source paper "flexible graph matching and graph edit distance using answer set programming"):
  with members:
    - "provmark a provenance expressiveness benchmarking system"
    - "practical graph isomorphism ii"

Connected through hyperedge HE-6 (induced by source paper "runtime analysis of whole system provenance"):
  with members:
    - "provenance based intrusion detection opportunities and challenges"
    - "saql a stream based query system for real time abnormal system behavior detection"
    - "struc2vec learning node representations from structural identity"
    - "camflow managed data sharing for cloud services"
    - "frappuccino fault detection through runtime analysis of provenance"
    - "high throughput ingest of provenance records into accumulo"
    - "attack analysis results for adversarial engagement 1 of the darpa transparent computing program"

Question: Please tell me which class the center node belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CR(Cryptography and Security)