1. A security appliance operatively coupled to a network, the security appliance comprising: at least one memory; at least one processor operatively coupled to the at least one memory, the at least one processor configured to: select a subpattern from each pattern in a set of one or more regular expression patterns based on at least one heuristic; generate a unified deterministic finite automata (DFA) using the subpatterns selected from all patterns in the set; generate at least one non-deterministic finite automata (NFA) for at least one pattern in the set, a portion of the at least one pattern used for generating the at least one NFA, and at least one walk direction for run time processing of the at least one NFA, being determined based on whether a length of the subpattern selected is fixed or variable and a location of the subpattern selected within the at least one pattern; and store the unified DFA and the at least one NFA generated in the at least one memory.