The invention discloses a method for preventing illegal transferring of interruption procedures of an
operating system, which mainly solves the problem that illegal transferring of the interruption procedures of the
operating system by attackers cannot be prevented in the prior art. The method for preventing illegal transferring includes steps of modifying the interruption procedures of the
operating system, transmitting specific information to a
virtual machine manager when the interruption starts and stops; and modifying the
virtual machine manager. When the
virtual machine manager receives information of interruption starting, values of a CS (
client /
server) and an IP (
internet protocol) register on current stacks of the operating
system can be stored into an FILO (first in later out) array; when the virtual
machine manager receives information of interruption stopping, the values of the CS and the IP register stored at the head of the FILO array can be extracted to be compared with the values on the current stacks of the operating
system, if the values of the CS and the IP register are different from those of the current stacks of the operating
system, execution of the operating system is stopped so as to prevent illegal transferring of the attackers. By the aid of the virtual
machine manager,
control data in interruption context are protected, so that the attackers cannot transfer the executive procedures of the operating system by distorting the
control data, and the method can be used for protecting safety of the operating system.