This paper is concerned with the model-free H_∞ control for cyber-physical systems with unknown dynamic models in the presence of denial-of-service(DoS) attacks, where DoS attacks are considered to be cost-constrained, and the number of successive attacks is bounded. Firstly, a Smith predictor with dropouts is designed to predict the current state using the measurement data, and the structure of the measurement feedback H_∞ controller is given. Secondly, the H_∞ control problem is transformed into a two-player zero-sum game, and then the designing method of the controller gain is presented using the game theory. Furthermore, an online Q-learning algorithm is designed to solve the controller gain with unknown model parameters, and the secure H_∞ control of the system is realized. Finally, an experiment on the plat of Carving is given to demonstrate the effectiveness of the proposed methods.