1. A method comprising: in a processor of a security appliance coupled to a network: generating an initial NFA for a set of patterns; generating an initial DFA for the set of patterns, the initial DFA generated having states representing a subset of the set of patterns and having at least one end-state, where each end-state maps to one or more states of the initial NFA for the set of patterns and represents a transition from processing the set of patterns as DFA to processing the set of patterns as NFA; adding states to the initial DFA, extending from the at least one end-state, to form an extended DFA for the set of patterns; mapping at least one of the added DFA states to one or more states of the NFA to form an end-state of the extended DFA, which when processed, transitions run time processing for finding the set of patterns in an input stream from DFA to NFA so that the portion of the set of patterns is found using DFA while a remaining portion of the set of patterns is found using the NFA; and in an event at least one pattern of the set of patterns has an overlapping pattern prefix with at least one other pattern of the set of patterns, the method further comprising: stripping from the at least one pattern the overlapping pattern prefix to form a stripped portion and stripped pattern based on at least one stripping criteria and dropping the at least one pattern from the set of patterns to find in the input stream in an event the at least one pattern in its entirety falls within any one of the at least one stripping criteria; and generating a reverse NFA for the stripped portion, wherein generating the initial DFA includes generating an initial DFA for the stripped pattern and the at least one other pattern and adding states to the initial DFA includes adding states to the initial DFA to form an extended DFA for the stripped pattern and the at least one other pattern.