Toward Fingerprinting Encrypted C2 Traffic in the Data Plane