When the distribution of training and test samples is inconsistent, the main problem for the practical application of tradi-tional machine learning algorithms in intrusion detection is that the detection accuracy is low. To solve the problem, this paper pro-poses an instruction detection method based on clustering analysis and transfer learning. Firstly, the hierarchical sampling technolo-gy based on clustering is used to obtain a small amount of labeled data for transfer classification training, so that the distribution ofdata for transfer classification is as similar as possible to the data distribution to be detected. Then the simple transfer classificationmodel is applied to the field of intrusion detection. The experimental results on the NSL-KDD data set show that the detection meth-od has higher detection accuracy than the traditional machine learning algorithms.