A method for detecting a man-in-the-middle attack, wherein the method comprises: receiving, by a macro eNodeB, MeNB, a first check request message sent by a secondary eNodeB, SeNB, wherein the first check request message comprises first identifier information of an evolved random access bearer, ERAB, and a first data packet count value corresponding to the first identifier information, wherein the first data packet count value reflects a count, obtained by the SeNB, of sent and received data packets of the bearer between the SeNB and a user terminal; obtaining, by the MeNB, second identifier information that matches the first identifier information, wherein the second identifier information is an identifier of data radio bearer, DRB, corresponding to the ERAB; receiving, by a user terminal, a second check request message sent by the MeNB, wherein the second check request message comprises the second identifier information corresponding to the first identifier information of an ERAB, and the first data packet count value corresponding to the first identifier information; obtaining, by the user terminal, the second identifier information corresponding to the first identifier information comprised in the second check request message, and a second data packet count value corresponding to the second identifier information, whereby the second data packet count value reflects a count, obtained by the user terminal, of sent and received data packets of the bearer between the SeNB and the user terminal; determining, by the user terminal according to the first data packet count value corresponding to the first identifier information, and the second data packet count value corresponding to the second identifier information, whether a man-in-the-middle attack exists between the SeNB, and the user terminal; and generating, by the user terminal, a check response message according to a result of the determining, and sending the check response message to the MeNB. receiving, by a macro eNodeB, MeNB, a first check request message sent by a secondary eNodeB, SeNB, wherein the first check request message comprises first identifier information of an evolved random access bearer, ERAB, and a first data packet count value corresponding to the first identifier information, wherein the first data packet count value reflects a count, obtained by the SeNB, of sent and received data packets of the bearer between the SeNB and a user terminal; obtaining, by the MeNB, second identifier information that matches the first identifier information, wherein the second identifier information is an identifier of data radio bearer, DRB, corresponding to the ERAB; receiving, by a user terminal, a second check request message sent by the MeNB, wherein the second check request message comprises the second identifier information corresponding to the first identifier information of an ERAB, and the first data packet count value corresponding to the first identifier information; obtaining, by the user terminal, the second identifier information corresponding to the first identifier information comprised in the second check request message, and a second data packet count value corresponding to the second identifier information, whereby the second data packet count value reflects a count, obtained by the user terminal, of sent and received data packets of the bearer between the SeNB and the user terminal; determining, by the user terminal according to the first data packet count value corresponding to the first identifier information, and the second data packet count value corresponding to the second identifier information, whether a man-in-the-middle attack exists between the SeNB, and the user terminal; and generating, by the user terminal, a check response message according to a result of the determining, and sending the check response message to the MeNB.