An information security protection host is provided. The information security protection host comprises a network interface and a virtual machine monitor (VMM) device. The network interface is connected to a computer network and is configured to receive a first packet. The VMM device is configured to run a first operating system, wherein the first operating system provides a first network service. The VMM device is further configured to provide a first operating system information of the first operating system and a first network service information of the first network service instantaneously so as to determine the security of the first packet.