1. A computer method, comprising: detecting a plurality of suspect peer packets in a traffic flow of data based on a heuristic model; detecting a plurality of verified peer packets in the plurality of suspect peer packets based on deep packet inspection; processing the plurality of verified peer packets according to a peer policy; and processing packets of the traffic flow not detected as one of the plurality of verified peer packets according to a non-peer policy.