1. A model-based content classification system for use in a firewall, comprising: a user interface that receives from a user one or more user-configurable bounds on searching content; a pattern matching engine that receives the one or more user-configurable bounds from the user interface, wherein the pattern matching engine is stored in a memory associated with the firewall and wherein execution of the pattern matching engine by a processor associated with the firewall: searches a string having known content, for a predetermined pattern, the search limited according to the received user-configurable bounds, computes a plurality of scores indicating a likelihood that the content of the string corresponds to one or more predetermined content categories, and updates the scores using a plurality of weights associated with the predetermined pattern in response to detecting the predetermined pattern; a content classification model generator that receives the updated scores from the pattern matching engine, wherein the content classification model generator is stored in the memory associated with the firewall and wherein execution of the content classification model generator by the processor associated with the firewall: generates a content classification model based on the updated scores, and transmits the content classification model to a model repository stored in memory; a network interface of the firewall that receives subsequent content over a network connection, the subsequent content directed to a client computer that is communicatively coupled to the firewall; a content classification engine stored in the memory associated with the firewall, wherein execution of the content classification engine by the processor associated with the firewall: accesses the content classification model stored in the model repository, and classifies the subsequent content based on the content classification model; a content filter stored in the memory associated with the firewall, wherein execution of the content filter by the processor associated with the firewall transmits at least a subset of the subsequent content to the client computer, the subset selected based on the classification of the subsequent content.