I think most websockets do not sustain large amounts of bidirectional traffic for prolonged periods, so IMO this would immediately be suspicious.