16. A network device configured to provide content based security, comprising: circuitry for scanning a message segment to define a stream of tokens associated with the message segment, wherein the message segment further comprises a packet in a packet-switched network; circuitry for extracting substructures from the stream of tokens, according to a grammar; circuitry for associating the message with a meta session, wherein the meta session is made persistent across message transactions and different HTTP sessions by storing data generated by the meta session on a persistent storage medium; circuitry for identifying rules associated with the tokens, wherein the rules define actions for intrusion detection and prevention; and circuitry for executing the identified rules.
16. A network device configured to provide content based security, comprising: circuitry for scanning a message segment to define a stream of tokens associated with the message segment, wherein the message segment further comprises a packet in a packet-switched network; circuitry for extracting substructures from the stream of tokens, according to a grammar; circuitry for associating the message with a meta session, wherein the meta session is made persistent across message transactions and different HTTP sessions by storing data generated by the meta session on a persistent storage medium; circuitry for identifying rules associated with the tokens, wherein the rules define actions for intrusion detection and prevention; and circuitry for executing the identified rules. 19. The network device of claim 16 , further comprising: circuitry for determining a grammar type of the message.