At present,intrusion detection system faces some problems: a large quantity of data,memory lacking,and so on.Applying a two-stage clustering algorithm to the intrusion detection,a IDS model based on data stream is designed.The empirical results manifest that the system can achieve a higher detection rate and a low rate of false positives,with adaptability and scalability,and effectively reduce the demand for memory.