The application discloses a method and device for detecting denial of a service attack, relates to the field of communication, and is used for solving the technical problem in the prior art that detection of denial of a service attack is not accurate enough. The method includes the following steps: a gateway device receives a response message sent by a server based on an application layer protocol; the response message is used for responding to a resource access request message based on an application layer protocol from a client, and the resource access request message carries a uniform resource locator (URL) of a resource provided by the server; feature information of the response message is obtained; and whether the server is subjected to denial of the service attack is determined according to the feature information. The method is used for detecting denial of the service attack.