A threat detection method, comprising: obtaining, by a threat detection apparatus, packets in a Transmission Control Protocol, TCP, session between a first device and a second device, wherein an initiating-end device of the TCP session is the first device, the first device is located in a protected network, and the second device is located in another network; obtaining, by the threat detection apparatus, a first data flow and a second data flow in the TCP session, wherein the first data flow is a data flow transmitted from the first device to the second device, and the second data flow is a data flow transmitted from the second device to the first device; obtaining, by the threat detection apparatus, time information of each of a plurality of first packets and time information of each of a plurality of second packets, wherein the plurality of first packets are packets in the first data flow, and the plurality of second packets are packets in the second data flow; calculating, by the threat detection apparatus, an activation rate, a response rate, and a quantity of interactions based on the time information of each first packet and the time information of each second packet, wherein the activation rate is a probability that data sent by the first device to the second device in the TCP session is triggered by the second device, the response rate is a probability that data sent by the second device to the first device in the TCP session is responded to by the first device in time, and the quantity of interactions is a quantity of interactions between the first device and the second device in the TCP session; if the activation rate is greater than or equal to a first threshold, the response rate is greater than or equal to a second threshold, and the quantity of interactions is greater than or equal to a third threshold, determining, by the threat detection apparatus, that a connection mode between the first device and the second device is a reverse connection; and if the connection mode between the first device and the second device is a reverse connection, determining, by the threat detection apparatus, that the first device is threatened. obtaining, by a threat detection apparatus, packets in a Transmission Control Protocol, TCP, session between a first device and a second device, wherein an initiating-end device of the TCP session is the first device, the first device is located in a protected network, and the second device is located in another network; obtaining, by the threat detection apparatus, a first data flow and a second data flow in the TCP session, wherein the first data flow is a data flow transmitted from the first device to the second device, and the second data flow is a data flow transmitted from the second device to the first device; obtaining, by the threat detection apparatus, time information of each of a plurality of first packets and time information of each of a plurality of second packets, wherein the plurality of first packets are packets in the first data flow, and the plurality of second packets are packets in the second data flow; calculating, by the threat detection apparatus, an activation rate, a response rate, and a quantity of interactions based on the time information of each first packet and the time information of each second packet, wherein the activation rate is a probability that data sent by the first device to the second device in the TCP session is triggered by the second device, the response rate is a probability that data sent by the second device to the first device in the TCP session is responded to by the first device in time, and the quantity of interactions is a quantity of interactions between the first device and the second device in the TCP session; if the activation rate is greater than or equal to a first threshold, the response rate is greater than or equal to a second threshold, and the quantity of interactions is greater than or equal to a third threshold, determining, by the threat detection apparatus, that a connection mode between the first device and the second device is a reverse connection; and if the connection mode between the first device and the second device is a reverse connection, determining, by the threat detection apparatus, that the first device is threatened.