I've always thought that this would be the way to do it. Run a smart DNS proxy/server that does pattern matching on the DNS query/response traffic using both t

I've always thought that this would be the way to do it. Run a smart DNS proxy/server that does pattern matching on the DNS query/response traffic using both traffic profile and query contents as features, then when you see something that matches for a given time window, stop service for that client and complain.