The invention belongs to the technical field of network security, and particularly relates to the technical field of software defined network (SDN) security defense. According to the technical scheme, an SDN-oriented DDoS attack defense system comprises a data acquisition module, a training module, an identification module, and a flow table issuing module. A defense method comprises the following steps: collecting OpenFlow flow table data on switches in an SDN, training and classifying different types of flow, identifying and marking DDoS attack flow, and intercepting the flow by means of OpenFlow blocking flow table issuing. The system and the method can be well deployed in an SDN environment, and can be used to effectively intercept DDoS attack flow and attacks like source IP address forging.