Abstract: Provided are an OpenFlow controller that performs DDoS attack detection based on SVM-SOM combination in a software-defined network and a method thereof. The OpenFlow controller collects flow information from multiple OpenFlow switches, extracts predetermined multiple attributes from a flow, classifies a traffic type of the flow on the basis of the extracted attributes, classifies an attack flow on the basis of one or more first attributes among the extracted attributes through an SVM corresponding to the classified traffic type among multiple linear SVMs, and determines whether a flow which is not classified as an attack flow by the SVM is a suspicious pattern through a SOM on the basis of second attributes greater in number than the first attributes among the extracted attributes, and classifies an attack type of the flow classified as an attack flow by the SVM or determined as a suspicious pattern by the SOM.