Information centric networking (ICN) is the next generation of internet architecture with its ability to provide in-network caching that make users retrieve their data efficiently regardless of their location. In ICN, security is applied to data itself rather than communication channels or devices. In-network caches are vulnerable to many types of attacks, such as cache poisoning attacks, cache privacy attacks, and cache pollution attacks (CPA). An attacker floods non-popular content to the network and makes the caches evict popular ones. As a result, the cache hit ratio for legitimate users will suffer from a performance degradation and an increase in the content’s retrieval latency. In this paper, a popularity variation mechanism in a CCN-SDN environment (PV-CSDN) is proposed to detect and mitigate CPA. PV-CSDN is based on observing the behavior of legitimate users to learn the normal traffic pattern and record the required threshold values. Two key parameters are used to achieve the threshold values: the popularity of the contents and the average rate of repeated requests for each interface in the router. The current traffic pattern will be compared with the predefined thresholds and if any variation in the traffic is occurred the attack is detected. The algorithm was able to detect the attack, and as a mitigation process, the controller will block the malicious interface to prevent any further degradation in the performance. The experiments show that PV-CSD detects and prevents the attack effectively.