The present invention relates to a device and a method for detecting keep-alive, comprising a collecting unit for collecting or capturing a plurality of packets transceiving between a plurality of wireless terminals and a plurality of servers, a preprocessing unit for mapping collecting or capturing time information of the packets which collected or captured by the collecting unit to at least one of identification information of wireless terminal, server identification information and port information, a slot allocation unit for allocating the mapped packets to each time slots on a timeline which generated according to the collecting or capturing time information, an ID(identification) assigning unit for assigning IDs to each sections on the timeline, wherein the assigning unit assigning same IDs to sections having time slots in which the packets are continuously allocated within a predetermined range; and a keep-alive detection unit for setting the sections which assigned same IDs to periodic sections, and for determining the periodic sections to keep-alive sections when ports of the packets allocated to the time slots on the periodic sections are continuously changing.