1. A device for detecting network traffic content, the device comprising: a first physical input port to receive signatures of content desired to be detected; a second physical input port to receive, over a first network, network traffic content; a physical output port to retransmit, over a second network, processed network traffic content; a memory configured for storing one or more signatures received via the first physical input port, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content, wherein the content desired to be detected include known macro virus strings; and a processor configured to: receive, via the second physical input port, data associated with network traffic content, extract one or more macros from the network traffic content; analyze the behavior of the one or more macros from the network traffic content for known peculiar behavioral patterns; execute one or more macro based instructions based on the one or more signatures and the data, responsive to a portion of the one or more macros matching the content desired to be detected, perform at least one remedial action including removal of the matching portion of the one or more macros; and retransmit, via the physical output port, the network traffic content, wherein the first physical input port receives the signatures of content desired to be detected via a network other than the first and second networks; and the first and second physical input ports and the physical output port are each wire-based network ports.