A worm detection method, comprising: obtaining (S201) first session information of a first host in a first time window, wherein the first session information is session information of the first host actively connecting to one or more other hosts; determining (S202), based on the first session information, a data feature corresponding to the first host, wherein the data feature corresponding to the first host is used to describe behavior of the first host accessing the one or more other hosts; and analyzing (S203), based on a worm detection model, the data feature corresponding to the first host to obtain a prediction result, wherein the worm detection model is a model generated by training, by using a preset training method and based on data features corresponding to a plurality of hosts in a first network in which the first host is located, and the prediction result is used to indicate whether the first host is worm-infected, wherein the first session information comprises information about at least two sessions, and information about each session in the information about the at least two sessions comprises at least one of a 5-tuple of the session, a byte quantity of the session, a packet quantity of the session, a transmission control protocol flag of the session, start time of the session, or end time of the session, and wherein the data feature corresponding to the first host comprises at least one of a quantity of short sessions, or a percentage of the quantity of short sessions in a quantity of all sessions; wherein the short session is a session whose ratio of a byte quantity of the session to a packet quantity of the session is less than a threshold. obtaining (S201) first session information of a first host in a first time window, wherein the first session information is session information of the first host actively connecting to one or more other hosts; determining (S202), based on the first session information, a data feature corresponding to the first host, wherein the data feature corresponding to the first host is used to describe behavior of the first host accessing the one or more other hosts; and analyzing (S203), based on a worm detection model, the data feature corresponding to the first host to obtain a prediction result, wherein the worm detection model is a model generated by training, by using a preset training method and based on data features corresponding to a plurality of hosts in a first network in which the first host is located, and the prediction result is used to indicate whether the first host is worm-infected, wherein the first session information comprises information about at least two sessions, and information about each session in the information about the at least two sessions comprises at least one of a 5-tuple of the session, a byte quantity of the session, a packet quantity of the session, a transmission control protocol flag of the session, start time of the session, or end time of the session, and wherein the data feature corresponding to the first host comprises at least one of a quantity of short sessions, or a percentage of the quantity of short sessions in a quantity of all sessions; wherein the short session is a session whose ratio of a byte quantity of the session to a packet quantity of the session is less than a threshold. <EOS>