1. A method, comprising: identifying, by a Network Function Virtualization (NFV) management system within a NFV-based network, a security DoS attack; identifying, by the NFV management system, a first hardware unit within the NFV-based network attacked by DoS requests associated with the security DoS attack; identifying, by the NFV management system, a second hardware unit that is a source of the security DoS attack; determining, by the NFV management system, a third hardware unit within the NFV-based network, closest to the source of the security DoS attack, that is communicatively located between the first hardware unit and the second hardware unit; and instructing, by the NFV management system, a security defense software program in the determined third hardware unit to intercept the security DoS attack such that processing load of DoS requests can be diverted closer to the source of the security DoS attack.