A method and apparatus for detecting a distributed denial of service (DDOS) attack is provided, wherein that method includes obtaining a feature portrait of a user, wherein the feature portrait includes at least one baseline; acquiring a flow packet to be measured and extracting alignment features in the flow packet to be measured; generating at least one feature factor based on the aligned feature and at least one baseline; feature factors are input into the training prediction model for DDOS attack detection. This method can improve the efficiency and accuracy of DDOS attack detection, and then reduce the false positive rate of DDOS attack.