A computer implemented method comprising: extracting, from network traffic data of a plurality of user devices in a computer network, one or more data fragments relating to a device model of each user device; associating the one or more data fragments with device identification data assigned to each user device; determining a device model for a specific data fragment of the one or more data fragments based on analyzing one or more data fields associated with the specific data fragment; and generating one or more device model identification rules based on the specific data fragment characterized in that generating the one or more device model identification rules further comprises: selecting one or more further data fragments as one or more device model identification rule candidates based on comparing the one or more further data fragments with the specific data fragment, wherein the one or more further data fragments that are determined to have the highest matching levels with the specific data fragment are selected; constructing a rule graph for each device model identification rule candidate; splitting each part of the device model identification rule candidate into separate nodes in the rule graph; generating a comparison by comparing each node with the specific data fragment; calculating a matching level for each node based on the comparison; and accepting or rejecting each device model identification rule candidate as the one or more device model identification rules based on the matching level; and generating the one or more device model identification rules based on the specific data fragment and on the accepted each device model identification rule candidate; extracting, from network traffic data of a plurality of user devices in a computer network, one or more data fragments relating to a device model of each user device; associating the one or more data fragments with device identification data assigned to each user device; determining a device model for a specific data fragment of the one or more data fragments based on analyzing one or more data fields associated with the specific data fragment; and generating one or more device model identification rules based on the specific data fragment characterized in that generating the one or more device model identification rules further comprises: selecting one or more further data fragments as one or more device model identification rule candidates based on comparing the one or more further data fragments with the specific data fragment, wherein the one or more further data fragments that are determined to have the highest matching levels with the specific data fragment are selected; constructing a rule graph for each device model identification rule candidate; splitting each part of the device model identification rule candidate into separate nodes in the rule graph; generating a comparison by comparing each node with the specific data fragment; calculating a matching level for each node based on the comparison; and accepting or rejecting each device model identification rule candidate as the one or more device model identification rules based on the matching level; and generating the one or more device model identification rules based on the specific data fragment and on the accepted each device model identification rule candidate; selecting one or more further data fragments as one or more device model identification rule candidates based on comparing the one or more further data fragments with the specific data fragment, wherein the one or more further data fragments that are determined to have the highest matching levels with the specific data fragment are selected; constructing a rule graph for each device model identification rule candidate; splitting each part of the device model identification rule candidate into separate nodes in the rule graph; generating a comparison by comparing each node with the specific data fragment; calculating a matching level for each node based on the comparison; and accepting or rejecting each device model identification rule candidate as the one or more device model identification rules based on the matching level; and generating the one or more device model identification rules based on the specific data fragment and on the accepted each device model identification rule candidate;