They may use data quantity as one red flag - that way they have less work on their plate - they focus on the "data hogs". I was not trying to imply that was their sole data usage. I have no doubt that they do something more in depth (like what you suggest) to target the actual users more. It's never going to be 100% - there will be some people who receive this in error - but AT&T just cannot legally use high data users as it's basis for these tethering charges. It would be discriminatory (since the unlimited data plan does not specify a limit), plus, as we have stated before, it would be inaccurate since people can legitimately use lots of data without tethering.or they look at the data and detect the tethering that way. It's not that hard - if a page is being accessed from a desktop version of a web browser, the person is tethering.
AT&T isn't run by idiots here, they don't want to risk the problems of a class action suit by falsely flagging tons of accounts - they are making sure that they are minimize false positives. Despite the fact that what they are doing is entirely proper (going after contract violators), they can't make too many mistakes or else they risk severe public backlash.
All of this "its based on high data usage" is pure guesswork since we don't know what goes on on AT&T's back-end. To say that it is based on one factor is just plane ignorance of network monitoring.