The invention provides a SDN-based protocol port protection method, apparatus and system, wherein the method comprises the following steps: a controller pre-sets a SDN-based protocol port protection algorithm configuration task sequence, wherein the task sequence comprises a static protocol port policy table; receiving a message of unmatched flow table reported by a switch , acquiring the source IP address, the destination IP address and the message type of the message, and matching a static protocol port policy table; if there is a matched table item, acquiring network topology structure and determining a forwarding path according to the source IP address, the destination IP address, and the network topology structure, and adding the forwarding path to the flow table to be issued to the switch so that the switch forwards the message according to the forwarding path. The SDN-based protocol port protection method, apparatus and system are based on a SDN, all configuration is concentrated in the controller, and the configuration is convenient and simple.