Identifying APT Malware Domain Based on Mobile DNS Logging

Figure 4

Difference distance between the C&C domains and normal domains.