The invention provides a scheme for monitoring an interactive behavior of a kernel module. A VM Func mechanism of the hardware virtualization technology is made use of, switchover of a VMM layer EPT page table can be completed without falling in a virtual machine monitor (VMM), and the number of times of falling in the VMM is reduced; a monitoring program is placed in an address space in a Guest OS, and falling in the VMM is not necessary in the monitoring process; the unnecessary virtual function of the VMM is removed, the Guest OS interacts directly with hardware, and thus the unnecessary performance cost is reduced. The number of times of falling in the VMM is reduced when the system runs, the isolation performance of the kernel module is improved, and the security of a kernel can be improved.