So you inspect filesystems or figure out other stats through low resource activity? There are probably logging systems already in place to detect abuse, that w

So you inspect filesystems or figure out other stats through low resource activity? There are probably logging systems already in place to detect abuse, that would be extended to detect VPN style usage on top of that.