| CPC H04L 47/2441 (2013.01) [G06N 20/00 (2019.01); H04L 43/04 (2013.01); H04L 43/062 (2013.01)] | 17 Claims |

|
1. A method, comprising:
obtaining network traffic from a network, wherein the network traffic is transmitted by a first device that is communicatively coupled to the network;
determining a set of features based on the network traffic;
determining a first classification for the first device based on the set of features and a first machine learning model, wherein determining the first classification comprises determining a first confidence level associated with the first classification, and wherein the first classification is associated with a first classification level;
in response to the first confidence level being above a threshold, selecting a second machine learning model from a plurality of machine learning models based on the first classification, wherein the second machine learning model is associated with the first classification;
determining a second classification for the first device based on the second machine learning model, wherein determining the second classification comprises determining a second confidence level associated with the second classification, and determining the second classification in response to the second confidence level being above the threshold, and wherein the second classification is associated with a second classification level; and
storing at least one of the first classification and the second classification.
|