What I understand is that they are using machine learning techniques to detect access patterns. Even if they don't understand the bytes because it is encrypted, they can match the sizes and timing of packets. So if the tunnel over SSH technique is common, and they detect a SSH connection that behaves in a specific way, for example because of fixed-size handshake packets, they can guess it is tunneling a VPN.