1. A security appliance operatively coupled to a network, the security appliance comprising: a plurality of memories configured to store nodes of at least one finite automaton, the at least one finite automaton including a given per-pattern non-deterministic finite automaton (NFA) of at least one per-pattern NFA, the given per-pattern NFA generated for a respective regular expression pattern and including a respective set of nodes; and at least one processor operatively coupled to the plurality of memories and configured to walk nodes of the respective set of nodes with segments of a payload of an input stream to match the respective regular expression pattern in the input stream, the respective set of nodes stored amongst one or more memories of the plurality of memories based on a node distribution determined as a function of hierarchical levels mapped to the plurality of memories and per-pattern NFA storage allocation settings configured for the hierarchical levels.