A method carried out by an intermediate network device, the method comprising the steps of: storing a set of full deterministic finite automaton, fDFA nodes, wherein the fDFA nodes represent a full deterministic finite automaton fDFA that accepts symbol streams that conform to a symbol pattern; creating a set of pDFA nodes, wherein the pDFA nodes represent a partial deterministic finite automaton, pDFA, wherein each of the pDFA nodes has a corresponding node in the fDFA nodes that has a visitation level that exceeds a visitation threshold, wherein each node in the pDFA nodes specifies a transition for a symbol to a failure node in the pDFA nodes when the corresponding node in the fDFA nodes specifies a transition for the symbol to a node in the fDFA nodes that has a visitation level that does not exceed the visitation threshold; receiving a symbol in a symbol stream, wherein each node in the pDFA nodes specifies a transition for a symbol to a node in the pDFA nodes when the corresponding node in the fDFA nodes specifies a transition for the symbol to a node in the fDFA nodes that has a visitation level that exceeds the visitation threshold; determining whether a current node of the pDFA nodes is a failure node; determining, when the current node of the pDFA nodes is not the failure node, whether the current node of the pDFA nodes specifies a transition for the symbol to the failure node; identifying, when the current node of the pDFA nodes specifies a transition for the symbol to the failure node, a node in the fDFA nodes that corresponds to the current node of the pDFA nodes as a current node of the fDFA nodes; and detecting a computer security threat when the current node of the pDFA nodes is the failure node and when the current node of the fDFA nodes specifies a transition for the symbol to an accepting node. storing a set of full deterministic finite automaton, fDFA nodes, wherein the fDFA nodes represent a full deterministic finite automaton fDFA that accepts symbol streams that conform to a symbol pattern; creating a set of pDFA nodes, wherein the pDFA nodes represent a partial deterministic finite automaton, pDFA, wherein each of the pDFA nodes has a corresponding node in the fDFA nodes that has a visitation level that exceeds a visitation threshold, wherein each node in the pDFA nodes specifies a transition for a symbol to a failure node in the pDFA nodes when the corresponding node in the fDFA nodes specifies a transition for the symbol to a node in the fDFA nodes that has a visitation level that does not exceed the visitation threshold; receiving a symbol in a symbol stream, wherein each node in the pDFA nodes specifies a transition for a symbol to a node in the pDFA nodes when the corresponding node in the fDFA nodes specifies a transition for the symbol to a node in the fDFA nodes that has a visitation level that exceeds the visitation threshold; determining whether a current node of the pDFA nodes is a failure node; determining, when the current node of the pDFA nodes is not the failure node, whether the current node of the pDFA nodes specifies a transition for the symbol to the failure node; identifying, when the current node of the pDFA nodes specifies a transition for the symbol to the failure node, a node in the fDFA nodes that corresponds to the current node of the pDFA nodes as a current node of the fDFA nodes; and detecting a computer security threat when the current node of the pDFA nodes is the failure node and when the current node of the fDFA nodes specifies a transition for the symbol to an accepting node.