human: Given a node-centered hypergraph: <hypergraph>, where nodes represent papers and hyperedges represent sets of papers co-cited by a source paper.

Details of the hypergraph:
Center node: "saql a stream based query system for real time abnormal system behavior detection"
  Abstract: Recently, advanced cyber attacks, which consist of a sequence of steps that involve many vulnerabilities and hosts, compromise the security of many well-protected businesses. This has led to the solutions that ubiquitously monitor system activities in each host (big data) as a series of events, and search for anomalies (abnormal behaviors) for triaging risky events. Since fighting against these attacks is a time-critical mission to prevent further damage, these solutions face challenges in incorporating expert knowledge to perform timely anomaly detection over the large-scale provenance data. #R##N#To address these challenges, we propose a novel stream-based query system that takes as input, a real-time event feed aggregated from multiple hosts in an enterprise, and provides an anomaly query engine that queries the event feed to identify abnormal behaviors based on the specified anomalies. To facilitate the task of expressing anomalies based on expert knowledge, our system provides a domain-specific query language, SAQL, which allows analysts to express models for (1) rule-based anomalies, (2) time-series anomalies, (3) invariant-based anomalies, and (4) outlier-based anomalies. We deployed our system in NEC Labs America comprising 150 hosts and evaluated it using 1.1TB of real system monitoring data (containing 3.3 billion events). Our evaluations on a broad set of attack behaviors and micro-benchmarks show that our system has a low detection latency (<2s) and a high system throughput (110,000 events/s; supporting ~4000 hosts), and is more efficient in memory utilization than the existing stream-based complex event processing systems.

Connected through hyperedge HE-1 (induced by source paper "unicorn runtime provenance based detector for advanced persistent threats"):
  with members:
    - "poirot aligning attack behavior with kernel audit records for cyber threat hunting"
    - "runtime analysis of whole system provenance"
    - "holmes real time apt detection through correlation of suspicious information flows"
    - "sleuth real time attack scenario reconstruction from cots audit data"
    - "how powerful are graph neural networks"
    - "benchmarking crimes an emerging threat in systems security"
    - "frappuccino fault detection through runtime analysis of provenance"
    - "practical whole system provenance capture"

Connected through hyperedge HE-2 (induced by source paper "querying streaming system monitoring data for enterprise system anomaly detection"):
  with members:
    - "aiql enabling efficient attack investigation from system monitoring data"

Connected through hyperedge HE-3 (induced by source paper "hyperservice interoperability and programmability across heterogeneous blockchains"):
  with members:
    - "ekiden a platform for confidentiality preserving trustworthy and performant smart contracts"
    - "concurrency and privacy with payment channel networks"
    - "keystone an open framework for architecting tees"
    - "atomic cross chain swaps"
    - "aiql enabling efficient attack investigation from system monitoring data"
    - "chainspace a sharded smart contracts platform"
    - "a concurrent perspective on smart contracts"
    - "enhancing bitcoin security and performance with strong consistency via collective signing"

Connected through hyperedge HE-4 (induced by source paper "poirot aligning attack behavior with kernel audit records for cyber threat hunting"):
  with members:
    - "runtime analysis of whole system provenance"
    - "holmes real time apt detection through correlation of suspicious information flows"
    - "propatrol attack investigation via extracted high level tasks"
    - "sleuth real time attack scenario reconstruction from cots audit data"
    - "aiql enabling efficient attack investigation from system monitoring data"
    - "behavior query discovery in system generated temporal graphs"
    - "detection of early stage enterprise infection by mining large scale log data"
    - "efficient subgraph matching on billion node graphs"

Connected through hyperedge HE-5 (induced by source paper "graalf supporting graphical analysis of audit logs for forensics"):
  with members:
    - "aiql enabling efficient attack investigation from system monitoring data"

Connected through hyperedge HE-6 (induced by source paper "runtime analysis of whole system provenance"):
  with members:
    - "provenance based intrusion detection opportunities and challenges"
    - "struc2vec learning node representations from structural identity"
    - "camflow managed data sharing for cloud services"
    - "frappuccino fault detection through runtime analysis of provenance"
    - "practical whole system provenance capture"
    - "high throughput ingest of provenance records into accumulo"
    - "attack analysis results for adversarial engagement 1 of the darpa transparent computing program"

Connected through hyperedge HE-7 (induced by source paper "attentional heterogeneous graph neural network application to program reidentification"):
  with members:
    - "xgboost a scalable tree boosting system"
    - "semi supervised classification with graph convolutional networks"
    - "convolutional neural networks on graphs with fast localized spectral filtering"
    - "diffusion convolutional neural networks"
    - "representation learning a review and new perspectives"

Connected through hyperedge HE-8 (induced by source paper "deep program reidentification a graph neural network solution"):
  with members:
    - "xgboost a scalable tree boosting system"
    - "semi supervised classification with graph convolutional networks"
    - "collaborative alerts ranking for anomaly detection"
    - "representation learning a review and new perspectives"

Question: Please tell me which class the center node belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CR(Cryptography and Security)