A method of detecting a Denial of Service, DoS, or a Distributed Denial of Service, DDoS, attack, comprising: acquiring traffic data of a preset service in a preset time period, wherein the traffic data is correspondence data between an overall traffic of the service and time; acquiring an overall traffic threshold data of the service corresponding to different time intervals calculated according to historical traffic data of the service; wherein the larger the historical traffic data of the time interval, the larger corresponding overall traffic threshold data of the service; determining the time interval corresponding to the acquired traffic data, and finding the overall traffic threshold corresponding to the time interval according to the determined time interval; comparing the traffic data with the found overall traffic threshold, and performing an attack detection to the service when a duration for which the traffic data keeps exceeding the overall traffic threshold exceeds a preset value characterised in that the method further comprises: collecting correspondence relation data of historical traffic value of the service and the time; setting adjacent historical traffic rate values with a difference therebetween being less than a preset value as interval traffic values in the same time interval; and calculating an average traffic value of the interval traffic values, and determining the overall traffic threshold of the time interval according to the average traffic value. acquiring traffic data of a preset service in a preset time period, wherein the traffic data is correspondence data between an overall traffic of the service and time; acquiring an overall traffic threshold data of the service corresponding to different time intervals calculated according to historical traffic data of the service; wherein the larger the historical traffic data of the time interval, the larger corresponding overall traffic threshold data of the service; determining the time interval corresponding to the acquired traffic data, and finding the overall traffic threshold corresponding to the time interval according to the determined time interval; comparing the traffic data with the found overall traffic threshold, and performing an attack detection to the service when a duration for which the traffic data keeps exceeding the overall traffic threshold exceeds a preset value characterised in that the method further comprises: collecting correspondence relation data of historical traffic value of the service and the time; setting adjacent historical traffic rate values with a difference therebetween being less than a preset value as interval traffic values in the same time interval; and calculating an average traffic value of the interval traffic values, and determining the overall traffic threshold of the time interval according to the average traffic value. collecting correspondence relation data of historical traffic value of the service and the time; setting adjacent historical traffic rate values with a difference therebetween being less than a preset value as interval traffic values in the same time interval; and calculating an average traffic value of the interval traffic values, and determining the overall traffic threshold of the time interval according to the average traffic value.