A software defined networking, SDN, system based distributed denial of service, DDoS, attack prevention method, wherein the SDN system comprises a controller and a plurality of packet forwarding devices, comprising: delivering, by the controller using a southbound interface of the controller, a first traffic statistics collection instruction to a first packet forwarding device of the plurality of packet forwarding devices, wherein the first traffic statistics collection instruction is used to instruct the first packet forwarding device to perform traffic statistics collection, wherein the first traffic statistics collection instruction carries a destination IP address, wherein the destination IP address is an IP address of a host; collecting, by the controller using the southbound interface, statistical data reported by the first packet forwarding device according to the first traffic statistics collection instruction, wherein the statistical data comprises statistical information of traffic flowing to the destination IP address through the first packet forwarding device; obtaining, by the controller according to the statistical data, a statistical value of global traffic flowing to the destination IP address, wherein the statistical value of the global traffic indicates a statistical value that is used to reflect traffic flowing to the destination IP address and being transmitted within a range of the SDN, and the statistical value of the global traffic is obtained after the controller summarizes statistical data reported by at least two packet forwarding devices comprising the first packet forwarding device; and determining, by the controller, whether the statistical value of the global traffic exceeds a preset threshold, and delivering a DDoS prevention policy to a second packet forwarding device based on a determining result that the statistical value of the global traffic exceeds the preset threshold. delivering, by the controller using a southbound interface of the controller, a first traffic statistics collection instruction to a first packet forwarding device of the plurality of packet forwarding devices, wherein the first traffic statistics collection instruction is used to instruct the first packet forwarding device to perform traffic statistics collection, wherein the first traffic statistics collection instruction carries a destination IP address, wherein the destination IP address is an IP address of a host; collecting, by the controller using the southbound interface, statistical data reported by the first packet forwarding device according to the first traffic statistics collection instruction, wherein the statistical data comprises statistical information of traffic flowing to the destination IP address through the first packet forwarding device; obtaining, by the controller according to the statistical data, a statistical value of global traffic flowing to the destination IP address, wherein the statistical value of the global traffic indicates a statistical value that is used to reflect traffic flowing to the destination IP address and being transmitted within a range of the SDN, and the statistical value of the global traffic is obtained after the controller summarizes statistical data reported by at least two packet forwarding devices comprising the first packet forwarding device; and determining, by the controller, whether the statistical value of the global traffic exceeds a preset threshold, and delivering a DDoS prevention policy to a second packet forwarding device based on a determining result that the statistical value of the global traffic exceeds the preset threshold.