1. A method, comprising: determining a device profile of a network device over one or more observation periods, by inspecting network traffic of the network device without deep packet inspection (DPI); matching the device profile to a first matching profile, based on a set of features derived from the network traffic; monitoring the network traffic of the network device for a device profile transition from the first matching profile to a second matching profile over an additional one or more observation periods; predicting behavior of the network device based on a history of profile matches; detecting deviations from predicted future behavior; and reacting to the profile transition with a programmed response based on a measure of significance wherein such reaction comprises taking corrective action based on a measure of significant deviation from the predicted future behavior.