The emerging software defined networking (SDN) offers a new way to rethink the defense of DDoS attacks. In this paper the DDoS attacks are first modeled and analyzed from the perspective of network architecture, and the necessary conditions of DDoS attacks such as connectivity, concealment and aggressivity are presented. Then for breaking or limiting these necessary conditions, a software defined security networking mechanism (SDSNM) against DDoS attacks is proposed. The security mechanism is implemented in the edge SDN networks while inheriting the core infrastructure of IP network. Cloud computing and Chord technology are also employed to solve the expansibility and consistency problems. The experiments demonstrate that SDSNM is feasible and incrementally deployable.