Provided are a DDoS attack detection method and apparatus. The method comprises: acquiring network traffic of a target moment within a first period by sampling, then querying a traffic period change curve acquired in advance, determining predicted traffic corresponding to the target moment, and confirming a DDoS attack if the network traffic acquired by sampling is larger than the determined predicted traffic. The traffic period change curve is used for indicating a period change law of the predicted traffic, so that before DDoS attack detection is performed at each target moment, it only needs to determine the predicted traffic corresponding to the target moment according to the traffic period change curve without calculating the predicted traffic according to massive historical traffic data before each DDoS attack detection; and the calculation volume is reduced.