Just speculating here. So just like timing and data sizes are used to correlate from end to end on a Tor network to deanonymize a user, can the same method be used on a single device to monitor and correlate incoming with outgoing traffic. This ensures that the device being monitored is not being use by as remote or as a relay (such as Tor) and if the data or timing is correlated then the server can deny login, a transaction, a service, etc.
I've tried looking up this notion but can't seem to find if it exists in practice or in another form. So I decided to ask openly. Thanks.