An IoT provider managing 2M+ connected devices needed to identify abnormal activity without disrupting legitimate services. DPI-based traffic classification identified 500 compromised smart meters generating abnormal DNS traffic, while policy controls blocked suspicious data transfers and allowed legitimate meter readings to continue.