Automated data exfiltration detection using netflow metadata