An attack data packet processing method, an apparatus, and a system are provided. The method includes receiving, by a management node, description information of an attack data packet and an attack type of the attack data packet, where the description information and the attack type are sent by an awareness node; determining a processing policy on the attack data packet of the attack type according to the attack type; and sending the description information and the processing policy to a switch using a software-defined networking controller, so that the switch performs an operation indicated by the processing policy on the attack data packet with the description information.