A network device classification process, including: monitoring network traffic of networked devices in a communications network to generate device behaviour data representing network traffic behaviours of the networked devices at different time granularities; processing the device behaviour data to classify a plurality of the networked devices as IoT devices, and others of the networked devices as non-IoT devices; accessing IoT device type data representing predetermined network traffic characteristics of respective known IoT device types; processing the device behaviour data of the IoT devices and the IoT device type data to classify each of the IoT devices as being a corresponding one of the plurality of known IoT device types; and for each of the IoT devices classified as a corresponding known IoT device type, classifying the IoT device as being in a corresponding operating state based on network traffic behaviours of the IoT device at different time granularities.