The invention discloses a kernel-based cross-terminal and cross-version Root attack detection and protection system. The kernel-based cross-terminal and cross-version Root attack detection and protection system comprises a Root monitoring subsystem for monitoring and detecting a Root attack, a Root protection subsystem which is connected with the Root monitoring subsystem and used for terminatingRoot attacks through system governance, and a private data protection module which is connected with the Root protection subsystem and used for hiding private data which a malicious program wants to read, wherein the Root monitoring subsystem comprises a monitoring control module used for monitoring Root attacks, and a file operation monitoring module, a process operation monitoring module and a memory operation monitoring module which are connected with the monitoring control module. By means of the scheme, the purpose of protecting the Android system during Root attacks of malicious programsis achieved, and high practical value and promotional value are achieved.