针对如何在软件定义网络(SDN)体系架构下设计管理灵活、复杂性可控的网络以及如何保障网络安全等问题,提出了一种面向业务、安全增强、软件定义(3S)的网络体系架构。基于3S架构,设计实现了一种针对中国铁路通信信号系统网络的统一安全管控方案,并借助3S特性及神经网络算法,设计实现了一种有效的分布式拒绝服务攻击(DDo S)检测方法。 Aimed at how to design a network with flexible management, complex control and how to ensure the network security in software defined network (SDN) architecture, this paper proposes a network architecture oriented to business, security enhancement and software definition (3S). Based on 3S architecture, a unified security control scheme for China’s railway signaling system is designed and implemented, and an effective distributed denial of service attack (DDo S) detection method is designed and implemented with 3S features and neural network algorithm.