Aimed at the problems that user’s business is different in demand for partiality and single defense strategy is limited in real network services, a virus propagation model and mixed defense strategy is proposed in operating system. First of all, the network is split into different subnets by adopting link interrupt and operating system migration strategies. In synthetic consideration of the correlation of the virus infection between subnets and virus propagation, an operating system virus propagation model is constructed, and the equilibrium solution and the stability analysis of the system are given. Secondly, by introducing the network service evaluation index and the definition of negative cost, a hybrid defense strategy is proposed to suppress the spread of operating system virus. The calculation method of optimal policy configuration, execution process and parameter identification algorithm are designed. The theoretical and experimental results show that the proposed virus propagation model and the hybrid defense strategy can effectively supplement the gap period of the traditional defense means in short supply.