In the Software Defined Optical Network（SDON）

control plane may encounter various intrusion threat

which may affect the stable and reliable service provisioning in the network. Aiming at control plane security problems in SDON

machine learning based intrusion detection strategy is proposed

which utilizes Isolation Forest algorithm to detect point anomalies and Exponentially Weighted Moving Average（EWMA） algorithm to detect sequence anomalies. Theoretical analysis and simulation experimental results show that the proposed SDON detection technology based on machine learning can achieve 90% accuracy of point anomaly detection and 85% accuracy of sequence anomaly detection.