16. An apparatus, comprising: a memory for storing program logic; and a processor operably coupled to the memory and configured by the program logic stored thereon to estimate a worst-case time complexity of a regular expression comprising one or more back-references (backref-regex), the regular expression defining a pattern adapted for identifying malicious packets, the program logic comprising: logic for constructing a non-deterministic finite automaton (NFA) corresponding to the backref-regex (backref-NFA), wherein the backref-NFA comprises a plurality of NFA-states and a respectively labeled edge for each of the one or more back-references of the backref-regex; logic for performing liveness analysis on the backref-NFA to determine for each NFA-state of the backref-NFA a set of back-references alive at the NFA-state; logic for determining a maximum number of alive back-references over the plurality of NFA-states, wherein the determined maximum number is indicative of the worst-case time complexity of the backref-regex; and if the indicated worst-case time complexity is below a pre-defined threshold, logic for selecting the pattern for use in identifying malicious packets.
16. An apparatus, comprising: a memory for storing program logic; and a processor operably coupled to the memory and configured by the program logic stored thereon to estimate a worst-case time complexity of a regular expression comprising one or more back-references (backref-regex), the regular expression defining a pattern adapted for identifying malicious packets, the program logic comprising: logic for constructing a non-deterministic finite automaton (NFA) corresponding to the backref-regex (backref-NFA), wherein the backref-NFA comprises a plurality of NFA-states and a respectively labeled edge for each of the one or more back-references of the backref-regex; logic for performing liveness analysis on the backref-NFA to determine for each NFA-state of the backref-NFA a set of back-references alive at the NFA-state; logic for determining a maximum number of alive back-references over the plurality of NFA-states, wherein the determined maximum number is indicative of the worst-case time complexity of the backref-regex; and if the indicated worst-case time complexity is below a pre-defined threshold, logic for selecting the pattern for use in identifying malicious packets. 17. The apparatus of claim 16 , wherein said apparatus is implemented within an intrusion detection system and intrusion prevention system (IDS/IPS) operative to analyze packets transiting between an unsecured network and a secured network.