a network intrusion detection system combines the normally sequential steps of protocol analysis , normalization , and signature matching through the use of a regular expression to speed the monitoring of network data . the regular expression also allows the creation of a superset matcher , permitting multiple stages of matching of increased accuracy to produce additional throughput gains .