The guidelines also deal with connections to unusual or high-risk IP addresses, traffic through uncommon ports, long-duration sessions involving relatively little data, encrypted traffic on non-standard ports, repeated connections to the same remote IP and unusually high data volumes during odd hours.
Do you have a loicence to encrypt traffic through that port?
IPDR can be matched with call detail records (CDRs), customer application forms (KYC details), and mobile tower data to provide a “complete picture of any user activity”, added the HT report.
Your home PC sure was downloading a lot of data while you're at work but not at home... You wouldn't be torrenting movies instead of buying a Netflix subscription would you?