16. A network device configured to provide content based security, comprising: circuitry for scanning a message segment to define a stream of tokens associated with the message segment, wherein the message segment further comprises a packet in a packet-switched network; circuitry for extracting substructures from the stream of tokens, according to a grammar; circuitry for associating the message with a meta session, wherein the meta session is made persistent across message transactions and different HTTP sessions by storing data generated by the meta session on a persistent storage medium; circuitry for identifying rules associated with the tokens, wherein the rules define actions for intrusion detection and prevention; and circuitry for executing the identified rules.
16. A network device configured to provide content based security, comprising: circuitry for scanning a message segment to define a stream of tokens associated with the message segment, wherein the message segment further comprises a packet in a packet-switched network; circuitry for extracting substructures from the stream of tokens, according to a grammar; circuitry for associating the message with a meta session, wherein the meta session is made persistent across message transactions and different HTTP sessions by storing data generated by the meta session on a persistent storage medium; circuitry for identifying rules associated with the tokens, wherein the rules define actions for intrusion detection and prevention; and circuitry for executing the identified rules. 17. The network device of claim 16 , wherein the circuitry for extracting substructures from the tokens includes, circuitry for retrieving meta session state information related to the message, wherein the meta session state information is invariant across different connections and a service context common to the different connections associates the different HTTP sessions of a user.