1. A security appliance operatively coupled to a network, the security appliance comprising: at least one network interface configured to receive an input stream including a payload, the security appliance configured to identify an existence of a respective regular expression pattern in the payload of the input stream prior to forwarding the payload; a plurality of memories configured to store nodes of at least one finite automaton, the at least one finite automaton including a given per-pattern non-deterministic finite automaton (NFA) of at least one per-pattern NFA, the given per-pattern NFA generated for the respective regular expression pattern and including a respective set of nodes; and at least one processor operatively coupled to the plurality of memories and the at least one network interface and configured to walk nodes of the respective set of nodes with segments of the payload to match the respective regular expression pattern in the input stream, performance of the security appliance improved by optimizing match performance of the at least one processor for identifying the existence of the respective regular expression pattern, the match performance optimized by having distributed and stored the respective set of nodes amongst one or more memories of the plurality of memories based on a node distribution determined as a function of hierarchical levels mapped to the plurality of memories and per-pattern NFA storage allocation settings configured for the hierarchical levels.