1. A method of operation within a malware detection device, the method comprising: comparing first characters in a network traffic flow with a plurality of entries within a first ternary content addressable memory (TCAM), the plurality of entries including a first entry that corresponds to a first part of a malware signature; in response to an output from the first TCAM indicating that the first characters match the first entry, determining within a coprocessor whether second characters in the network traffic flow match a first variable expression that (i) corresponds to a second part of the malware signature and (ii) may be matched by either of at least two different-length instances of the second characters; forming a first comparand value that includes third characters in the network traffic flow and an expression-match value, the expression-match value indicating whether the second characters have been determined by the coprocessor to match the first variable expression; comparing the first comparand value with the plurality of entries within the first TCAM; and conditionally blocking the network traffic flow based at least in part on whether the first comparand value is determined to match at least one of the entries within the first TCAM.