human: Given a node-centered hypergraph: <hypergraph>, where nodes represent papers and hyperedges represent sets of papers co-cited by a source paper.

Details of the hypergraph:
Center node: "aiql enabling efficient attack investigation from system monitoring data"
  Abstract: The need for countering Advanced Persistent Threat (APT) attacks has led to the solutions that ubiquitously monitor system activities in each host, and perform timely attack investigation over the monitoring data for analyzing attack provenance. However, existing query systems based on relational databases and graph databases lack language constructs to express key properties of major attack behaviors, and often execute queries inefficiently since their semantics-agnostic design cannot exploit the properties of system monitoring data to speed up query execution. #R##N#To address this problem, we propose a novel query system built on top of existing monitoring tools and databases, which is designed with novel types of optimizations to support timely attack investigation. Our system provides (1) domain-specific data model and storage for scaling the storage, (2) a domain-specific query language, Attack Investigation Query Language (AIQL) that integrates critical primitives for attack investigation, and (3) an optimized query engine based on the characteristics of the data and the semantics of the queries to efficiently schedule the query execution. We deployed our system in NEC Labs America comprising 150 hosts and evaluated it using 857 GB of real system monitoring data (containing 2.5 billion events). Our evaluations on a real-world APT attack and a broad set of attack behaviors show that our system surpasses existing systems in both efficiency (124x over PostgreSQL, 157x over Neo4j, and 16x over Greenplum) and conciseness (SQL, Neo4j Cypher, and Splunk SPL contain at least 2.4x more constraints than AIQL).

Connected through hyperedge HE-1 (induced by source paper "querying streaming system monitoring data for enterprise system anomaly detection"):
  with members:
    - "saql a stream based query system for real time abnormal system behavior detection"

Connected through hyperedge HE-2 (induced by source paper "hyperservice interoperability and programmability across heterogeneous blockchains"):
  with members:
    - "ekiden a platform for confidentiality preserving trustworthy and performant smart contracts"
    - "concurrency and privacy with payment channel networks"
    - "keystone an open framework for architecting tees"
    - "atomic cross chain swaps"
    - "saql a stream based query system for real time abnormal system behavior detection"
    - "chainspace a sharded smart contracts platform"
    - "a concurrent perspective on smart contracts"
    - "enhancing bitcoin security and performance with strong consistency via collective signing"

Connected through hyperedge HE-3 (induced by source paper "poirot aligning attack behavior with kernel audit records for cyber threat hunting"):
  with members:
    - "runtime analysis of whole system provenance"
    - "holmes real time apt detection through correlation of suspicious information flows"
    - "propatrol attack investigation via extracted high level tasks"
    - "sleuth real time attack scenario reconstruction from cots audit data"
    - "saql a stream based query system for real time abnormal system behavior detection"
    - "behavior query discovery in system generated temporal graphs"
    - "detection of early stage enterprise infection by mining large scale log data"
    - "efficient subgraph matching on billion node graphs"

Connected through hyperedge HE-4 (induced by source paper "graalf supporting graphical analysis of audit logs for forensics"):
  with members:
    - "saql a stream based query system for real time abnormal system behavior detection"

Connected through hyperedge HE-5 (induced by source paper "a query system for efficiently investigating complex attack behaviors for enterprise security"):
  with members:
    - "saql a stream based query system for real time abnormal system behavior detection"

Question: Please tell me which class the center node belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CR(Cryptography and Security)