Disclosed are a system of defending against a DDoS attack based on an SDN and a method thereof. According to the present invention, when the HTTP Request message suspected for the attack arrives at the web server, the web server sends the HTTP Request message to the SDN controller located in the network, and the SDN controller determines the DDoS attack instead of the web server which is the attack target and blocks the traffic from the attacker through the nodes on the network according to the determination result of the SDN controller. Thereby, the traffic suspected as the DDoS attack that exhausts available connection resources of the web server is input to the SDN controller instead of the web server. Thereby the web server can be protected from the DDoS attack and the maintenance of the normal operation of the web server can be secured.