1. A security appliance operatively coupled to a network, the security appliance comprising: a plurality of memories mapped to hierarchical levels in a memory hierarchy and at least one processor operatively coupled to the plurality of memories, the at least one processor configured to: generate at least one per-pattern non-deterministic finite automaton (NFA), each per-pattern NFA generated for a single regular expression pattern and including a respective set of nodes; and distribute nodes, of the respective set of nodes of each per-pattern NFA generated, for storing in the plurality of memories based on the hierarchical levels mapped and per-pattern NFA storage allocation settings configured for the hierarchical levels.