Are they charging you for bits down the wire? Or payload bytes in TCP and UDP packets (ie not charging for transport protocol layer overheads, ICMP, ARP, etc etc)? Or payload traffic through their web (etc) proxies (ie only charging for stuff that the end user would recognise as data they've downloaded)? Or ...?
My guess would be volume billing of anything, if they're doing it correctly it should be on a 95th percentile 5 minute basis but although that's the way its done wholesale, they might just be using total cumulative volume (or something else) rather than 95th percentile..... time to check their T&Cs me thinks !