1. A security appliance operatively coupled to a network, the security appliance comprising: at least one processor; at least one network interface configured to receive an input stream including a payload, the security appliance configured to identify an existence of at least one regular expression pattern in the payload of the input stream prior to forwarding the payload; a plurality of memories mapped to hierarchical levels in a memory hierarchy and operatively coupled to the at least one processor and the at least one network interface, the at least one processor configured to: generate at least one per-pattern non-deterministic finite automaton (NFA), each per-pattern NFA generated for a single regular expression pattern, of the at least one regular expression pattern, and including a respective set of nodes; and improve performance of the security appliance by optimizing match performance for identifying the existence of the at least one regular expression pattern, the match performance optimized by distributing nodes, of the respective set of nodes of each per-pattern NFA generated, in the plurality of memories based on the hierarchical levels mapped and per-pattern NFA storage allocation settings configured for the hierarchical levels.