When the distribution of training and test samples is inconsistent, the main problem for the practical application of traditional machine learning algorithms in intrusion detection is that the detection accuracy is low. To solve the problem, this paper proposes an instruction detection method based on clustering analysis and transfer learning. Firstly, the hierarchical sampling technology based on clustering is used to obtain a small amount of labeled data for transfer classification training, so that the distribution of data for transfer classification is as similar as possible to the data distribution to be detected. Then the simple transfer classification model is applied to the field of intrusion detection. The experimental results on the NSL-KDD data set show that the detection method has higher detection accuracy than the traditional machine learning algorithms