1. A network intrusion monitor comprising: a network connection; an electronic memory holding at least one regular expression providing in combination at least one of the processes of: protocol analysis and normalization, together with the process of matching to malware signatures; an electronic computer communicating with the network and memory and executing a stored program to: (1) read a string from the network; (2) apply the string against the regular expression to provide in combination at least one of the processes of: protocol analysis and normalization, together with the process of matching to malware signatures; and (3) output a signal indicating when the string has matched to a malware signature.