滥用入侵检测中使用的技术主要有:模式匹配、专家系统、状态转移等,其中模式匹配最为常用。本文主要对经典的单模式匹配算法BM算法进行介绍,重点对其好后缀规则进行分析,证明其并不是一个好的规则,因此BM算法的性能并不是最优的。最后,提出了对此算法与多模式树结合形成的多模式匹配算法AC—BM算法的改进。 Misuse intrusion detection techniques used are: pattern matching, expert systems, state transfer, etc., of which the most commonly used pattern matching. This paper mainly introduces the classic BM algorithm of single pattern matching algorithm, focusing on the analysis of its good suffix rule, which proves that it is not a good rule, so the performance of BM algorithm is not optimal. Finally, an improved AC-BM algorithm for multi-pattern matching algorithm based on this algorithm and multi-pattern tree is proposed.