The invention relates to a DDoS 
attack detection method based on an SDN, and belongs to the field of 
software defined networks. According to the method, the 
queue theory and the 
conditional entropy are used as a coarse-grained detection module of the arrival flow in the SDN environment, and 
machine learning is used as a fine-grained detection module, so malicious flow is accurately detected from legal packets, and the possibility that a 
server in a network is attacked is reduced while a controller is protected from being attacked. Coarse 
granularity detection is composed of two 
parallel detection modules, namely a multi-dimensional 
conditional entropy detection module and a controller entry 
queue length detection module, fine 
granularity detection is triggered when a detection result of any one module exceeds a threshold value, the fine 
granularity detection module collects flow table items and counter information from a switch based on an 
OpenFlow protocol for 
statistical processing, and the traffic is finally judged by using a 
random forest (RF) classification model which is trained and is placed in the controller, so as to effectively detect the 
attack traffic and prevent the controller from being damaged.