18. A tangible and non-transitory computer program product wherein computer instructions, when executed by a processor in a telecom network element, adapt operation of the telecom network element to provide a method for evaluating a pattern to determine if the pattern should be included within a set of patterns used by a malicious packet detector, the malicious packet detector comparing an input string representing a packet received at a network element to one or more patterns within the set of patterns to identify malicious packets, the method comprising: estimating worst-case time complexity of a regular expression comprising one or more back-references (backref-regex), the regular expression defining a pattern adapted for identifying malicious packets; and if the estimated worst-case time complexity is below a pre-defined threshold, selecting the pattern for inclusion within the set of patterns; wherein said estimating comprises: constructing a non-deterministic finite automaton (NFA) corresponding to the backref-regex (backref-NFA), wherein the backref-NFA comprises a plurality of NFA-states and a respectively labeled edge for each of the one or more back-references of the backref-regex; performing liveness analysis on the backref-NFA to determine for each NFA-state of the backref-NFA a set of back-references alive at the NFA-state; and determining a maximum number of alive back-references over the plurality of NFA-states, wherein the determined maximum number is indicative of the worst-case time complexity of the backref-regex.
18. A tangible and non-transitory computer program product wherein computer instructions, when executed by a processor in a telecom network element, adapt operation of the telecom network element to provide a method for evaluating a pattern to determine if the pattern should be included within a set of patterns used by a malicious packet detector, the malicious packet detector comparing an input string representing a packet received at a network element to one or more patterns within the set of patterns to identify malicious packets, the method comprising: estimating worst-case time complexity of a regular expression comprising one or more back-references (backref-regex), the regular expression defining a pattern adapted for identifying malicious packets; and if the estimated worst-case time complexity is below a pre-defined threshold, selecting the pattern for inclusion within the set of patterns; wherein said estimating comprises: constructing a non-deterministic finite automaton (NFA) corresponding to the backref-regex (backref-NFA), wherein the backref-NFA comprises a plurality of NFA-states and a respectively labeled edge for each of the one or more back-references of the backref-regex; performing liveness analysis on the backref-NFA to determine for each NFA-state of the backref-NFA a set of back-references alive at the NFA-state; and determining a maximum number of alive back-references over the plurality of NFA-states, wherein the determined maximum number is indicative of the worst-case time complexity of the backref-regex. 19. The computer program product of claim 18 , wherein said method further comprises forwarding patterns selected for use in identifying malicious packets toward a packet-matching engine adapted to determine whether incoming packets to be rejected.