Abstract: Aiming at the DDos attack in Software Defined Network（SDN）,a DDos recognition model based on Renyi cross entropy and the RMSprop（Root Mean Square Prop） algorithm is proposed.The model is divided into two-layer modules:The first module introduces the bidirectional flow ratio as the initial detection method of the early warning module,which can timely detect abnormal traffic in time while reducing the normal monitoring load.The identification module emplays the Renyi cross entropy algorithm as the similarity calculation method for traffic characteristics.This effectively increases the information distance between abnormal and normal traffic data,and can identify the initial low-traffic attacks of DDoS earlier. Meanwhile,RMSprop algorithm is introduced into the identification module to calculate the current network threshold,which can absorb instantaneous mutation and further improve the identification accuracy.The experimental results show that the model has the characteristics of low time cost and high recognition success rate,which can effectively increase the security of SDN.