human: Given a node-centered hypergraph: <hypergraph>, where nodes represent papers and hyperedges represent sets of papers co-cited by a source paper.

Details of the hypergraph:
Center node: "runtime analysis of whole system provenance"
  Abstract: Identifying the root cause and impact of a system intrusion remains a foundational challenge in computer security. Digital provenance provides a detailed history of the flow of information within a computing system, connecting suspicious events to their root causes. Although existing provenance-based auditing techniques provide value in forensic analysis, they assume that such analysis takes place only retrospectively. Such post-hoc analysis is insufficient for realtime security applications, moreover, even for forensic tasks, prior provenance collection systems exhibited poor performance and scalability, jeopardizing the timeliness of query responses. #R##N#We present CamQuery, which provides inline, realtime provenance analysis, making it suitable for implementing security applications. CamQuery is a Linux Security Module that offers support for both userspace and in-kernel execution of analysis applications. We demonstrate the applicability of CamQuery to a variety of runtime security applications including data loss prevention, intrusion detection, and regulatory compliance. In evaluation, we demonstrate that CamQuery reduces the latency of realtime query mechanisms, while imposing minimal overheads on system execution. CamQuery thus enables the further deployment of provenance-based technologies to address central challenges in computer security.

Connected through hyperedge HE-1 (induced by source paper "unicorn runtime provenance based detector for advanced persistent threats"):
  with members:
    - "poirot aligning attack behavior with kernel audit records for cyber threat hunting"
    - "holmes real time apt detection through correlation of suspicious information flows"
    - "sleuth real time attack scenario reconstruction from cots audit data"
    - "saql a stream based query system for real time abnormal system behavior detection"
    - "how powerful are graph neural networks"
    - "benchmarking crimes an emerging threat in systems security"
    - "frappuccino fault detection through runtime analysis of provenance"
    - "practical whole system provenance capture"

Connected through hyperedge HE-2 (induced by source paper "poirot aligning attack behavior with kernel audit records for cyber threat hunting"):
  with members:
    - "holmes real time apt detection through correlation of suspicious information flows"
    - "propatrol attack investigation via extracted high level tasks"
    - "sleuth real time attack scenario reconstruction from cots audit data"
    - "saql a stream based query system for real time abnormal system behavior detection"
    - "aiql enabling efficient attack investigation from system monitoring data"
    - "behavior query discovery in system generated temporal graphs"
    - "detection of early stage enterprise infection by mining large scale log data"
    - "efficient subgraph matching on billion node graphs"

Connected through hyperedge HE-3 (induced by source paper "provmark a provenance expressiveness benchmarking system"):
  with members:
    - "camflow managed data sharing for cloud services"
    - "frappuccino fault detection through runtime analysis of provenance"
    - "practical whole system provenance capture"

Connected through hyperedge HE-4 (induced by source paper "viewpoint personal data and the internet of things it is time to care about digital provenance"):
  with members:
    - "high throughput ingest of provenance records into accumulo"
    - "provabs model policy and tooling for abstracting prov graphs"
    - "provenance views for module privacy"

Connected through hyperedge HE-5 (induced by source paper "appmine behavioral analytics for web application vulnerability detection"):
  with members:
    - "process monitoring on sequences of system call count vectors"
    - "practical whole system provenance capture"

Connected through hyperedge HE-6 (induced by source paper "holmes real time apt detection through correlation of suspicious information flows"):
  with members:
    - "sleuth real time attack scenario reconstruction from cots audit data"
    - "malicious behavior detection using windows audit logs"

Question: Please tell me which class the center node belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CR(Cryptography and Security)