identifying a plurality of device names corresponding to a plurality of devices from traffic logs generated for a network;

based on extracting features from each of the plurality of device names, generating a plurality of feature vectors, wherein each of the plurality of feature vectors comprises features extracted from a corresponding one of the plurality of device names;

clustering the plurality of feature vectors into a plurality of clusters;

determining if any of the plurality of clusters satisfy a size criterion; and

based on determining that a first cluster of the plurality of clusters satisfies the size criterion, identifying the first cluster as corresponding to a multi-network interface card (NIC) device.