A method for realizing security detection in a heterogeneous network, wherein User Equipment establishes cross-Evolved NodeB (eNB) double/multiple connections with a Macro eNB (MeNB) and a Low Power Node in an access network which is a kind of heterogeneous network, the LPN is responsible for data distribution, and the data distribution is layered by Radio Bearers; the MeNB receives a report message from the LPN through a backhaul interface between the MeNB and the LPN, and the report message contains a data count sent/received between the LPN and the UE; the method comprising: transmitting Control Plane information between the MeNB and the UE to compare data counts actually sent/received between the access network and the UE to detect whether there is insertion of an attacker or not; the method further comprising: when the LPN sends the report message or when the MeNB receives the report message, adding the number of data packets transmitted within a transmission time of the report message to a specific data count corresponding to the report message; or when the LPN sends the report message, attaching, by the LPN, a time value to indicate the data count sent/received between the LPN and the UE up to a moment when the time value is reached; and moreover, sending, by the MeNB, a counter check message to the UE after receiving the report message from the LPN, the counter check message containing DRBs between the MeNB and the UE, data counts generated on DRBs between the LPN and the UE in uplink and downlink directions, and the time value. transmitting Control Plane information between the MeNB and the UE to compare data counts actually sent/received between the access network and the UE to detect whether there is insertion of an attacker or not; the method further comprising: when the LPN sends the report message or when the MeNB receives the report message, adding the number of data packets transmitted within a transmission time of the report message to a specific data count corresponding to the report message; or when the LPN sends the report message, attaching, by the LPN, a time value to indicate the data count sent/received between the LPN and the UE up to a moment when the time value is reached; and moreover, sending, by the MeNB, a counter check message to the UE after receiving the report message from the LPN, the counter check message containing DRBs between the MeNB and the UE, data counts generated on DRBs between the LPN and the UE in uplink and downlink directions, and the time value. when the LPN sends the report message or when the MeNB receives the report message, adding the number of data packets transmitted within a transmission time of the report message to a specific data count corresponding to the report message; or when the LPN sends the report message, attaching, by the LPN, a time value to indicate the data count sent/received between the LPN and the UE up to a moment when the time value is reached; and moreover, sending, by the MeNB, a counter check message to the UE after receiving the report message from the LPN, the counter check message containing DRBs between the MeNB and the UE, data counts generated on DRBs between the LPN and the UE in uplink and downlink directions, and the time value.