A computer-implemented method comprising: accessing a packet of a communication associated with a device (122a-b, 120, 130) coupled to a network; accessing a plurality of portions of the packet; determining a first plurality of values, each value of the first plurality of values corresponding to a respective portion of the packet and an identification feature of a plurality of identification features; accessing a first threshold value; determining a first confidence score based on at least one of the first plurality of values; comparing the first confidence score to the first threshold value; in response to the first confidence score being higher than the first threshold value, determining that the device has been identified; in response to the first confidence score being less than the first threshold value: scanning one or more ports of the device (122a-b, 120, 130) to obtain a result of the port scanning; determining a second plurality of values, each value of the second plurality of values corresponding to the result of the port scanning and an identification feature of the plurality of identification features; accessing a second threshold; determining a second confidence score based on the first plurality of values and the second plurality of values; comparing the second confidence score with the second threshold, and in response to the second confidence score being greater than the threshold, determining that the device has been identified; and upon determining that the device has been identified, storing the second identification of the device (122a-b, 120, 130). accessing a packet of a communication associated with a device (122a-b, 120, 130) coupled to a network; accessing a plurality of portions of the packet; determining a first plurality of values, each value of the first plurality of values corresponding to a respective portion of the packet and an identification feature of a plurality of identification features; accessing a first threshold value; determining a first confidence score based on at least one of the first plurality of values; comparing the first confidence score to the first threshold value; in response to the first confidence score being higher than the first threshold value, determining that the device has been identified; in response to the first confidence score being less than the first threshold value: scanning one or more ports of the device (122a-b, 120, 130) to obtain a result of the port scanning; determining a second plurality of values, each value of the second plurality of values corresponding to the result of the port scanning and an identification feature of the plurality of identification features; accessing a second threshold; determining a second confidence score based on the first plurality of values and the second plurality of values; comparing the second confidence score with the second threshold, and in response to the second confidence score being greater than the threshold, determining that the device has been identified; and upon determining that the device has been identified, storing the second identification of the device (122a-b, 120, 130). scanning one or more ports of the device (122a-b, 120, 130) to obtain a result of the port scanning; determining a second plurality of values, each value of the second plurality of values corresponding to the result of the port scanning and an identification feature of the plurality of identification features; accessing a second threshold; determining a second confidence score based on the first plurality of values and the second plurality of values; comparing the second confidence score with the second threshold, and in response to the second confidence score being greater than the threshold, determining that the device has been identified; and upon determining that the device has been identified, storing the second identification of the device (122a-b, 120, 130).