With the advance of optimization and merger colleges and universities, a university often contains more than one campus. The traditional centralized education management system has been unable to meet the needs of use. The model detects the intrusion by dividing the clusters in the clustering result into normal clusters and abnormal clusters and analyzing the weighted average density of object x to be detected in each cluster and the weighted overlapping distance of x and each centre point. We verified the intrusion detection performance of the model on the KDD Cup 99 dataset. The experimental results show that the model established in this paper has certain theoretical value.