Techniques for performing Internet of Things (IoT) device identification are disclosed. Information associated with a network communication of an IoT device is received. A determination of one or more confidence scores that represent how well the received information matches respective one or more network behavior pattern identifiers is made. A determination is made that each one of the one or more determined confidence scores is below a threshold. In response to determining that each of the one or more determined confidence scores is below the threshold, a two-part classification process is performed, where a first portion includes an inline classification, and a second portion includes a subsequent verification of the inline classification. A result of the classification process is provided to a security appliance configured to apply a policy to the IoT device.