A computing system for learning a device type and message formats used by a device is provided. The computing system includes an interface and a processor. The interface is receptive of documents describing identification information and communication and application protocols of devices. The processor is coupled with the interface to obtain rules of network packet analysis using document analytics and identify identification information and communication and application protocols of network messages from devices using the rules.