1. A computer method, comprising: receiving a plurality of packets in a traffic flow; processing all of the plurality of packets in the traffic flow in a first stage based on heuristic model analysis to detect a plurality of suspect peer packets in the traffic flow; processing only the plurality of suspect peer packets in a second stage based on deep packet inspection to detect a plurality of verified peer packets in the plurality of suspect peer packets, wherein verified peer control and data packets are detected separately in the plurality of suspect peer packets based on the deep packet inspection; processing the plurality of verified peer packets according to a peer policy, wherein the peer policy includes dropping the verified peer control packets to prevent subsequent verified peer data packet exchange and transmitting the verified peer data packets at a restricted rate; and processing packets of the traffic flow not detected as one of the plurality of verified peer packets according to a non-peer policy.