The embodiment of the invention discloses a message detecting method, comprising the steps of: extracting actual values of behavior features of a message to be detected; generating metadata by using the actual values of the behavior features according to a conversion rule; interpolating the metadata into the message to be detected; and searching a state machine by using the metadata, wherein the metadata is used for recognizing the message to be detected, and the state machine is obtained by performing regular conversion compiling on the behavior features of a sample message according to the rule. Correspondingly, the embodiment of the invention discloses a message detecting device; a uniform detection process flow for detecting the behavior features is provided by means of the technical scheme, so that the changes of the behavior features are upgraded in a lossless manner, the logic treatment for the behavior features is simplified, the performance for detecting the behavior features is promoted, and the maintainability and the reliability of the behavior features are increased.