Systems and methods classify unknown devices communicating over a packet-switched network based on traffic-borne characteristics comprising packet parameters, flow parameters, and/or operating-system parameters. Embodiments utilize “self-learning” to optimize the level of classification accuracy.