1. A method comprising: in a processor of a security appliance coupled to a network: walking an input of a sequence of characters through a deterministic finite automata (DFA) graph generated for at least one given regular expression pattern to enable inspection of packet content, the at least one given regular expression employed to detect a security breach or an intrusion; and at a marked node of the DFA graph, the marked node being a node that marks a match of the at least one given regular expression pattern: based on a specific type of the at least one given regular expression pattern matching at the marked node, walking the input sequence of characters through a reverse non-deterministic finite automata (rNFA) graph by walking the input sequence of characters backwards through the rNFA graph beginning from an offset of the input sequence of characters associated with the marked node, the rNFA graph generated for the at least one given regular expression pattern and having at least one processing node inserted therein, the at least one processing node inserted into the rNFA graph based on the specific type of the at least one regular expression pattern; and based on the specific type of the at least one given regular expression pattern not matching at the marked node, reporting the match of the at least one given regular expression pattern.