1. A network intrusion monitor comprising: a network connection receiving data strings; an electronic memory holding a plurality of regular expressions, each regular expression providing in combination at least one of the processes of: protocol analysis and normalization, together with the process of matching to malware signatures, a match of a data string with the regular expression indicating that the string is a portion of a malware data string; an electronic computer communicating with the network and memory and executing a stored program to: read a string from the network; apply the string against a regular expression, in one processing of the string, to provide each of the processes of: a protocol analysis and normalization, together with the process of matching to malware signatures to detect a match without separate readings of the string from the network for the separate processes; and output an alarm signal indicating when the string has matched to a malware signature as indicated by the match; wherein the electronic memory further holds superset regular expressions matching both known malware strings and known benign strings and wherein the electronic computer after reading a string from the network and before applying the string against the regular expression executes the stored program to: apply the string against the superset regular expression in one processing of the string to provide in combination each of the processes of: protocol analysis, normalization, and signature matching of the string; and when the superset regular expression matches the string, proceeding to the step of applying the string against the regular expression and otherwise returning to the step of reading a string from the network for a new string from the network.