I think every company uses the same process of blocking IP addresses that generate suspicious traffic as a way to mitigate attacks. However, that is a never ending process of chasing attackers instead of being one step ahead of attackers.
Are there any methods that go beyond just blocking the IP of suspicious traffic? Especially since any attacker worth anything will always be spoofing their IP.
For example, is there a way to: flag suspicious traffic, analyze the traffic, create a fingerprint of the traffic, develop a signature based on the fingerprint, and finally automate the process of preemptively suppress traffic that match the tainted signature.
Does that make sense? Please ask clarifying questions if it doesn't make sense.
PS: This is my first SE post so I hope everything is in order.