A method of detecting a Denial of Service, DoS, or a Distributed Denial of Service, DDoS, attack, comprising: acquiring (S202) traffic data of a preset service in a preset time period, wherein the traffic data is correspondence data between an overall traffic of the service and time; acquiring (S204) an overall traffic threshold data of the service corresponding to different time intervals calculated according to historical traffic data of the service; wherein the larger the historical traffic data of the time interval, the larger corresponding overall traffic threshold data of the service; determining (S206) the time interval corresponding to the acquired traffic data, and finding the overall traffic threshold corresponding to the time interval according to the determined time interval; comparing (S208) the traffic data with the found overall traffic threshold, and performing an attack detection to the service when a duration for which the traffic data keeps exceeding the overall traffic threshold exceeds a preset value characterised in that the method further comprises: collecting (S402) correspondence relation data of historical traffic value of the service and the time; setting (S404) adjacent historical traffic rate values with a difference therebetween being less than a preset value as interval traffic values in the same time interval; and calculating (S406) an average traffic value of the interval traffic values, and determining the overall traffic threshold of the time interval according to the average traffic value. acquiring (S202) traffic data of a preset service in a preset time period, wherein the traffic data is correspondence data between an overall traffic of the service and time; acquiring (S204) an overall traffic threshold data of the service corresponding to different time intervals calculated according to historical traffic data of the service; wherein the larger the historical traffic data of the time interval, the larger corresponding overall traffic threshold data of the service; determining (S206) the time interval corresponding to the acquired traffic data, and finding the overall traffic threshold corresponding to the time interval according to the determined time interval; comparing (S208) the traffic data with the found overall traffic threshold, and performing an attack detection to the service when a duration for which the traffic data keeps exceeding the overall traffic threshold exceeds a preset value characterised in that the method further comprises: collecting (S402) correspondence relation data of historical traffic value of the service and the time; setting (S404) adjacent historical traffic rate values with a difference therebetween being less than a preset value as interval traffic values in the same time interval; and calculating (S406) an average traffic value of the interval traffic values, and determining the overall traffic threshold of the time interval according to the average traffic value. collecting (S402) correspondence relation data of historical traffic value of the service and the time; setting (S404) adjacent historical traffic rate values with a difference therebetween being less than a preset value as interval traffic values in the same time interval; and calculating (S406) an average traffic value of the interval traffic values, and determining the overall traffic threshold of the time interval according to the average traffic value. <EOS>