The invention provides a DDoS attack detection device and method for an SDN controller based on entropy, and the device comprises a network data package collection module, a data package information statistics module and an entropy value calculation module, wherein the network data package collection module, the data package information statistics module and the entropy value calculation module are respectively connected with a configuration information management module. The device achieves the effective detection of the DDoS attack of the SDN controller through employing the interaction between the above modules. The device accurately finds an early signal of the DDoS attack from a network flow passing through the SDN controller based on the entropy theory, reduces the response time of the DDoS attack of the SDN controller, and alleviates the impact on the SDN controller from the DDoS attack.