Do companies using Git tend to use it over SSH like personal github/Bitbucket works? If so, that's presumably a lot of noise in this genius detection scheme.
There would be very different traffic patterns. Git over SSH would be a shortlived session with high data speeds, an interactive shell is longer with lower throughput changing in fits and starts. The popularity and hostnames of ssh servers also give some hints. Noise in detection would all depends on how intricate the monitoring is and how well it can be queried.
