20. A method comprising: receiving content at an analysis engine; tokenizing the content into a plurality of parts including first parts and second parts; analyzing the first parts via the analysis engine; receiving at a generic decoder the second part the analysis engine, wherein the analysis engine includes one or more protocol parsers, and wherein the generic decoder is configured to operate based on generic application-level protocol analysis language primitives; analyzing, via the generic decoder, the second parts for a signature including executing code corresponding to at least one first generic application-level protocol analysis language primitive to skip to a location in the second parts, and at least one second generic application-level protocol analysis language primitive to match a pattern in the second parts, wherein the second parts are not analyzed by the analysis engine and have a same protocol as the first parts; indicating the signature is detected in response to matching the pattern in the second parts; and indicating the signature does not apply to the second parts in response to encountering a token that does not match the pattern.
21. The method of claim 20 , further comprising: selecting the second parts from the plurality of parts based on whether the second parts have a predetermined file format and corresponding file extension; and in response to the second parts having the predetermined file format and corresponding file extension, analyzing the second parts via the analysis engine.