Due to the large number, wide distribution and complex environments of Internet of Things (IoT) devices, IoT is more vulnerable to DDoS (Distributed Denial of Service) attacks than traditional networks. Concerning this problem, a Distributed Denial of Service (DDoS) attack detection method based on Equal Length of Value Range K-means (ELVR- Kmeans) algorithm in Software Defined IoT (SD-IoT) architecture was proposed. Firstly, the centralized control characteristic of the SD-IoT controller was used to extract the flow tables of the OpenFlow switch to analyze the DDoS attack traffic characteristics in SD-IoT environment and extract the seven-tuple features related to the DDoS attack traffic. Secondly, the obtained flow tables were classified by the ELVR- Kmeans algorithm to detect whether a DDoS attack had occurred. Finally, the simulation experiment environment was built to test the detection rate, accuracy and error rate of the method. The simulation results show that the proposed method can effectively detect DDoS attacks in SD-IoT environment with detection rate and accuracy of 96.43% and 98.71% respectively, and error rate of 1.29%.