A computer system, characterized by comprising: an openflow switch, configured to receive a plurality of packets; a network controller, coupled to the openflow switch and configured to determine a route of each of the plurality of packets; and a detecting and defending system, configured to perform transformation of information formats of the plurality of packets, retrieve and label the plurality of packets to determine whether the plurality of packets are abnormal or not and generate a defending determination; wherein the detecting and defending system comprises: a control module, coupled to the network controller via an interface and configured to update a plurality of openflow rules to a database; an analyze module, coupled to the network controller via the interface and configured to transform the information formats of the plurality of packets and label a plurality of signaling signatures corresponding to the information formats of the plurality of packets; an allocation module, coupled to the network controller via the interface and configured to perform an allocation of the plurality of packets according to the defending determination; a signature detecting module, coupled to the database and the analyze module, and configured to compare the plurality of signaling signatures corresponding to the information formats of the plurality of packets with the database to determine a first result; a deep learning module, coupled to the database and the analyze module, and configured to take the plurality of signaling signatures corresponding to the information formats of the plurality of packets as input information for classification of a deep neural network, abbreviated to DNN, to determine a second result; and a determination module, coupled to the signature detecting module and the deep learning module, and configured to generate the defending determination according to the first result and the second result. an openflow switch, configured to receive a plurality of packets; a network controller, coupled to the openflow switch and configured to determine a route of each of the plurality of packets; and a detecting and defending system, configured to perform transformation of information formats of the plurality of packets, retrieve and label the plurality of packets to determine whether the plurality of packets are abnormal or not and generate a defending determination; wherein the detecting and defending system comprises: a control module, coupled to the network controller via an interface and configured to update a plurality of openflow rules to a database; an analyze module, coupled to the network controller via the interface and configured to transform the information formats of the plurality of packets and label a plurality of signaling signatures corresponding to the information formats of the plurality of packets; an allocation module, coupled to the network controller via the interface and configured to perform an allocation of the plurality of packets according to the defending determination; a signature detecting module, coupled to the database and the analyze module, and configured to compare the plurality of signaling signatures corresponding to the information formats of the plurality of packets with the database to determine a first result; a deep learning module, coupled to the database and the analyze module, and configured to take the plurality of signaling signatures corresponding to the information formats of the plurality of packets as input information for classification of a deep neural network, abbreviated to DNN, to determine a second result; and a determination module, coupled to the signature detecting module and the deep learning module, and configured to generate the defending determination according to the first result and the second result. a control module, coupled to the network controller via an interface and configured to update a plurality of openflow rules to a database; an analyze module, coupled to the network controller via the interface and configured to transform the information formats of the plurality of packets and label a plurality of signaling signatures corresponding to the information formats of the plurality of packets; an allocation module, coupled to the network controller via the interface and configured to perform an allocation of the plurality of packets according to the defending determination; a signature detecting module, coupled to the database and the analyze module, and configured to compare the plurality of signaling signatures corresponding to the information formats of the plurality of packets with the database to determine a first result; a deep learning module, coupled to the database and the analyze module, and configured to take the plurality of signaling signatures corresponding to the information formats of the plurality of packets as input information for classification of a deep neural network, abbreviated to DNN, to determine a second result; and a determination module, coupled to the signature detecting module and the deep learning module, and configured to generate the defending determination according to the first result and the second result.