Nah, it is probably directly the xserver, or even the firmware of the display hardware block. An easy vector is the steam client or games. Hardware virtualization is amazing for complex malware/spyware.

You would have to man-in-the-middle your network traffic then use a custom communication path to handle the correlation with your network usage with the right data probe added to the linux kernel ethernet driver. The problem: since I cannot remove the wifi hardware from my motherboard, all that is useless.