Multi-turn covert exfiltration detection