The invention provides a method and a device for detecting low-speed denial-of-service attack. The method comprises the following steps: periodically detecting a parameter of a network link in a first level; when a detecting value of the parameter is lower than a set lower limit value, entering second-level detection; in the second-level detection, sampling set times of the parameter of the network link in a set time length; when a statistical sampling result exceeds a set normal value range, entering third-level detection; in the third detection, sampling the parameter of the network link; calculating power spectrum density of sampling data; comparing frequency domain characteristics of the power spectrum density and the low-speed denial-of-service attack; and outputting a detecting result. The embodiment of the invention can detect the low-speed denial-of-service attack by lower detection cost.