Due to characteristics of high bandwidth and low latency, datacenter networks ensure tremendous data could be transmitted in an efficient way. However, in many‐to‐one transmission scenarios, high concurrency of TCP flows aggravates network congestion and causes overflows in switches, seriously impairing network performance. To solve the problem, a TCP congestion control mechanism based on software‐defined networking (STCC) is proposed. Without any modification in TCP stack, STCC monitors network performance through centralized control and global network view of SDN, employs a routing algorithm based on the minimum path bandwidth utilization rate to forward packets and uses different methods to adjust congestion windows of senders so that network congestion can be greatly mitigated. An experiment platform is built to carry out simulation tests for evaluating STCC, and the results show that under the same network conditions, STCC effectively reduces the number of retransmission timeout of senders and noticeably raises network throughput, compared with other congestion control algorithms.

In traditional networks, DDoS attacks are often launched in the network layer or the transport layer. Researchers had explored this problem in depth and put forward plenty of solutions. However, these solutions are only suitable for scenarios such as a single link or victim side network and could not analyse traffic distribution from the angle of the global network. Also, the TCP/IP network architecture lacks abilities to quickly conduct resource deployment and traffic scheduling. When DDoS attacks occur, victims usually could not respond in time. With the superiorities of centralized control mode and global topological view, Software-Defined Networking (SDN) provides a new way to get over the above issues. In this paper, we adopt a combination of diverse technologies to design SDNDefender, a SDN-based DDoS detection and defense mechanism, which is composed of two core components aiming to counter the most popular DDoS attacks including IP spoofing attack and TCP SYN flood attack. We carry out quantitative simulation experiments for evaluating SDNDefender from many metrics. The experimental results show that in contrast to other DDoS defense algorithms, SDNDefender not only efficiently validates spoofed packets and withstands well-known attacks but also defends unknown attacks according to the target’s available resources. Besides, SDNDefender could significantly reduce TCP half-open connections and improve detection accuracy, alleviating attack influences that exhaust the server’s resources and network bandwidth.