23. The security appliance of claim 19 wherein the processor is further configured to walk the rNFA graph from the offset of the input sequence of characters associated with the marked node and determine whether the given regular expression pattern matched by the DFA graph includes a possible matching back-reference.
24. The security appliance of claim 23 wherein the specific type of the at least one given regular expression pattern is a back reference type and the processor is further configured to determine at least one of the following: a start offset of the possible matching back-reference, end offset of the possible matching back-reference, and length of the possible matching back-reference.