One problem in your discussion is that attackers have gotten savier in their approach to getting data out by using HTTP with an encrypted data stream. They have also been seen using ports other than 80 and 443 as long as they are open to an external IP address they control. Again, the data is encrypted so that what is leaving cannot be readily identified. As a result, you need to look at large transmissions to anywhere which is where things can get potentially obscured with legitimate traffic.