Hm, that's pretty good idea... some new software type called Disconnector or something, and then when you spot the intruder, you would open up the Disconnector and boot him out of the system, maybe also take his admin access.
This should work like the scanner, you just input his IP and the program checks if the hacker has your admin access / connection and disconnects him. Of course there will also be an Anti-disconnect program that he will run in order to hide from the Disconnector.
This should have to be instant with no waiting time, input IP, quick check, found or not, disconnect or not.
Could be done, good idea