23. The security appliance of claim 19 wherein the processor is further configured to walk the rNFA graph from the offset of the input sequence of characters associated with the marked node and determine whether the given regular expression pattern matched by the DFA graph includes a possible matching back-reference.
19. A security appliance coupled to a network, the security appliance comprising: a processor implemented in hardware configured to: walk an input of a sequence of characters through a deterministic finite automata (DFA) graph generated for at least one given regular expression pattern to enable inspection of packet content, the at least one given regular expression employed to detect a security breach or an intrusion; and at a marked node of the DFA graph: based on a specific type of the at least one given regular expression pattern matching at the marked node, walk the input sequence of characters through a reverse non-deterministic finite automata (rNFA) graph by walking the input sequence of characters backwards through the rNFA graph beginning from an offset of the input sequence of characters associated with the marked node, the rNFA graph generated for the at least one given regular expression pattern and having at least one processing node inserted therein, the at least one processing node inserted into the rNFA graph based on the specific type of the at least one regular expression pattern; and based on the specific type of the at least one given regular expression pattern not matching at the marked node, reporting the match of the at least one given regular expression pattern.