1. A computer method, comprising: receiving a plurality of packets in a traffic flow; processing all of the plurality of packets in the traffic flow in a first stage based on heuristic model analysis to detect a plurality of suspect peer packets in the traffic flow; processing only the plurality of detected suspect peer packets of the plurality of packets of the traffic flow in a second stage based on deep packet inspection to detect a plurality of verified peer packets in the plurality of suspect peer packets; processing the plurality of verified peer packets according to a peer policy; and processing each packet of the traffic flow that is not detected as one of the plurality of verified peer packets according to a non-peer policy.