Fingerprint creation and comparing historical data streams

The method includes identifying a protocol data stream from a first unit, the first unit of an unknown unit type. The method further includes identifying features in the protocol data stream from the first unit. The method further includes determining a likelihood that the protocol data stream generated by the first unit by a specific device type, on the basis of comparing characteristics of the identified protocol data stream from the first unit and of features in log data streams from a plurality of known device types.