The invention discloses a matching rule engine supporting a combined expression of multivariate protocol variables, and relates to the technical field of information. The matching rule engine is composed of a rule definition device, a lexical parser, a grammar parser, a compiler and a binary code generator. The rule definition device is composed of a rule input device, a rule detection engine anda rule output device. According to the matching rule engine, an extended Berkeley packet filtering technology is improved, so that rule grammar of the matching rule engine can be customized, and function nesting calling, function variable reference, cache range offset and nesting expression evaluation are supported. According to the matching rule engine, the JIT technology is adopted, dynamic compilation is carried out into machine code operation, the execution efficiency can be comparable to that of a C program, and good system portability is achieved.