1. A method comprising: in a processor of a security appliance coupled to a network, by the processor: monitoring data received by the security appliance from the network; converting a nondeterministic finite automata (NFA) graph for a given set of patterns to a deterministic finite automata (DFA) graph having a number of DFA states, the processor employing the DFA graph in order to apply the given set of patterns to the data for the monitoring, wherein the converting includes: mapping a DFA state of the number of DFA states to a corresponding set of one or more NFA states of the NFA graph; computing a first hash value of the one or more NFA states of the corresponding set; storing the first hash value in an entry of a DFA states table correlating the DFA state to the first hash value; and determining a transition DFA state from the DFA state for a character of an alphabet recognized by the NFA graph, based on whether a second hash value of transitions of the one or more NFA states for the character exists in an Epsilon Closure (EC) cache table, the EC cache table including hash value entries mapped to DFA states, and wherein, in an event the second hash value exists, setting the transition DFA state to be a given DFA state, the given DFA state mapped to the second hash value in the EC cache table.
1. A method comprising: in a processor of a security appliance coupled to a network, by the processor: monitoring data received by the security appliance from the network; converting a nondeterministic finite automata (NFA) graph for a given set of patterns to a deterministic finite automata (DFA) graph having a number of DFA states, the processor employing the DFA graph in order to apply the given set of patterns to the data for the monitoring, wherein the converting includes: mapping a DFA state of the number of DFA states to a corresponding set of one or more NFA states of the NFA graph; computing a first hash value of the one or more NFA states of the corresponding set; storing the first hash value in an entry of a DFA states table correlating the DFA state to the first hash value; and determining a transition DFA state from the DFA state for a character of an alphabet recognized by the NFA graph, based on whether a second hash value of transitions of the one or more NFA states for the character exists in an Epsilon Closure (EC) cache table, the EC cache table including hash value entries mapped to DFA states, and wherein, in an event the second hash value exists, setting the transition DFA state to be a given DFA state, the given DFA state mapped to the second hash value in the EC cache table. 3. The method of claim 1 wherein mapping includes: determining whether there are unmarked DFA states within the number of DFA states; selecting one of the unmarked DFA states to produce an unmarked DFA state; marking the unmarked DFA state to produce a marked DFA state; and determining the transitions of the one or more NFA states of the NFA graph mapped to the marked DFA state to other NFA states for the character of the alphabet recognized by the NFA graph.