A network switch for an industrial control system, ICS, the network switch comprising: a first port configured for communication with a first electric device in a deterministic network; a second port configured for communication with a second electric device in the deterministic network; one or more processors in communication with the first port and the second port, the one or more processors configured to perform operations, the operations comprising: receiving at the first port a communication packet, intended for the second electric device, from the first electric device; determining if the communication packet satisfies a plurality of protocol constraints; in response to the communication packet satisfying the plurality of protocol constraints, inputting one or more message characteristics from the communication packet into one or more models associated with one or more industrial processes of the ICS, the one or more models configured to output a process behavioral classification based at least in part on the one or more message characteristics, wherein the process behavioral classification is indicative of an effect of transmitting the communication packet to the second electronic device on the ICS; receiving, as output of the one or more models in response to the one or more message characteristics, the process behavioral classification for the communication packet; and selectively generating a control action for the ICS based at least in part on the process behavioral classification; wherein selectively generating the control action comprises selectively transmitting the communication packet to the second electric device based at least in part on the process behavioral classification; and wherein the one or more models include a physics-based model or a machine-learned model generated by inputting a plurality of message characteristics from a first sequence of communication packets corresponding to the one or more industrial processes and observing an outcome or results of the one or more industrial processes. a first port configured for communication with a first electric device in a deterministic network; a second port configured for communication with a second electric device in the deterministic network; one or more processors in communication with the first port and the second port, the one or more processors configured to perform operations, the operations comprising: receiving at the first port a communication packet, intended for the second electric device, from the first electric device; determining if the communication packet satisfies a plurality of protocol constraints; in response to the communication packet satisfying the plurality of protocol constraints, inputting one or more message characteristics from the communication packet into one or more models associated with one or more industrial processes of the ICS, the one or more models configured to output a process behavioral classification based at least in part on the one or more message characteristics, wherein the process behavioral classification is indicative of an effect of transmitting the communication packet to the second electronic device on the ICS; receiving, as output of the one or more models in response to the one or more message characteristics, the process behavioral classification for the communication packet; and selectively generating a control action for the ICS based at least in part on the process behavioral classification; wherein selectively generating the control action comprises selectively transmitting the communication packet to the second electric device based at least in part on the process behavioral classification; and wherein the one or more models include a physics-based model or a machine-learned model generated by inputting a plurality of message characteristics from a first sequence of communication packets corresponding to the one or more industrial processes and observing an outcome or results of the one or more industrial processes. receiving at the first port a communication packet, intended for the second electric device, from the first electric device; determining if the communication packet satisfies a plurality of protocol constraints; in response to the communication packet satisfying the plurality of protocol constraints, inputting one or more message characteristics from the communication packet into one or more models associated with one or more industrial processes of the ICS, the one or more models configured to output a process behavioral classification based at least in part on the one or more message characteristics, wherein the process behavioral classification is indicative of an effect of transmitting the communication packet to the second electronic device on the ICS; receiving, as output of the one or more models in response to the one or more message characteristics, the process behavioral classification for the communication packet; and selectively generating a control action for the ICS based at least in part on the process behavioral classification; wherein selectively generating the control action comprises selectively transmitting the communication packet to the second electric device based at least in part on the process behavioral classification; and wherein the one or more models include a physics-based model or a machine-learned model generated by inputting a plurality of message characteristics from a first sequence of communication packets corresponding to the one or more industrial processes and observing an outcome or results of the one or more industrial processes.