1. A method of operation within a malware detection device having a content-addressable memory (CAM), the method comprising: receiving a plurality of malware detection rules that are to be searched for within an input traffic stream supplied to the malware detection device via an electronic communications network; generating, for each one of the rules, a sequence of state definitions that correspond to respective segments of the one of the rules and that specify conditions under which a state machine is to transition between search states corresponding to the segments, at least one of the segments corresponding to multiple characters within the input traffic stream; storing, within respective storage rows of the CAM, character strings that correspond to respective segments of the rules, including storing, as one of the character strings, the multiple characters that correspond to the at least one of the segments of the one of the rules; iteratively comparing portions of the input traffic stream with the character strings stored within the CAM in respective search cycles to produce compare-result signals, the storage rows of the CAM having ternary CAM cells that, in a given one of the search cycles, compare the character strings stored within the storage rows with one of the portions of the input traffic stream in parallel such that iteratively comparing the portions of the input traffic stream with the character strings stored within the CAM comprises, in each of the search cycles, concurrently comparing the character strings stored within the CAM with the input traffic stream; transitioning the state machine between search states corresponding to the one of the rules in accordance with contents of the input traffic stream and the conditions specified by the sequence of state definitions, including transitioning the state machine between search states based at least in part on whether the compare-result signals indicate match between contents of the input traffic stream and contents of the CAM; and signaling affirmative detection of a malware expression within the input traffic stream upon transitioning the state machine from a search state that corresponds to a final one of the segments of the one of the rules.