1. A method comprising: in at least one processor operatively coupled to at least one network interface, a plurality of memories in a memory hierarchy, and a node cache, in a security appliance operatively coupled to a network: storing a plurality of nodes of at least one finite automaton in the plurality of memories for identifying existence of at least one regular expression pattern in an input stream received via the at least one network interface; and caching a given node and one or more additional nodes, of the plurality of nodes, stored in a given memory of the plurality of memories at a hierarchical level in the memory hierarchy, in the node cache based on a cache miss of the given node, the one or more additional nodes cached based on a hierarchical node transaction size associated with the hierarchical level, optimizing match performance of the at least one processor for identifying the existence of the least one regular expression pattern in the input stream.