1. A method comprising: in a processor of a security appliance coupled to a network: converting a nondeterministic finite automata (NFA) graph for a given set of patterns to a deterministic finite automata (DFA) graph having a number of states, converting the NFA graph including: mapping each of the number of DFA states to one or more states of the NFA graph; computing a hash value of the one or more states of the NFA graph mapped to each DFA state; storing a DFA states table correlating each of the number of DFA states to the hash value of the one or more states of the NFA graph for the given pattern.