To reply to my own question .
Can we find a way to create a "signature" of an account's pattern of editing? Perhaps it might be a set of signatures, maybe one for the categories that the account appears to be active in, another for the type of edit, etc. Then if these signatures were calculated for all banned accounts or currently blocked accounts (or at least ones with a long enough contribution history to make it worthwhile - we're not interested in one-edit vandals), then we could have a tool that could be run to quickly compare one account against the signatures of banned/blocked accounts as well as the cumulative edits of a set of known sockpuppets (i.e. treat them as a single account) to determine if this may be a sockpuppet case meriting further investigation. I imagine that it would be too expensive computationally to actually run comparisons of the contribution histories of all "bad guy" accounts against the suspicious account which is why I propose a "signature" approach (but I'm happy to be told otherwise).
If we had such a tool and it proves reasonably reliable in identifying likely sockpuppets (not asking for guarantees but close enough not to be a waste of time to investigate), then we could routinely use it on new accounts or reactivating accounts (i.e. possible sleeper accounts) once they have a long enough editing history to enable the tool to operate effectively to provide automated early warning of new/reactivating accounts appearing suspiciously similar to "bad guy" accounts.
But this is a hard problem, both technically and socially (Assume Good Faith, Privacy, etc), so I welcome the thoughts of others.
Kerry