1. In a computing environment, a method comprising: obtaining, by an engine, a signature including executable logic for detecting the signature and a state machine for tracking a state of a protocol defined by the executable logic of the signature, wherein the signature is authored in a definition language of safe constructs; obtaining one or more expressions from the signature through providing the one or more expressions from the executable logic to a protocol analyzer associated with the engine; causing a safe compiler to compile the signature into safe source code; causing the safe source code to be compiled into intermediate language code; causing an interpreter to interpret the intermediate language code to determine that the executable logic of the signature is signed by a publisher; causing the interpreter to generate tokens by parsing network traffic according to one or more expressions obtained from the executable logic; sending the generated tokens to the state machine of the signature; allowing the state machine of the signature to use the generated tokens to track the state of the protocol as the network traffic is processed by the engine; receiving a detected pattern of content from the state machine based on the tokens used by the state machine; and responsive to receiving the detected pattern of content from the state machine based on the used tokens, iteratively providing a next group of one or more expressions to evaluate that are received from the executable logic to the protocol analyzer until an expression match is found.