In the intrusion detection process of dynamic clonal selection algorithm, the antigens detected by memory detectors and maturity detectors are directly considered as self immature detectors to be tolerated. But there may be new attacks hidden in these antigens. To solve this problem, a new idea with clustering analysis is proposed. The clustering algorithm cluster remaining antigens then analyzes data existing in small cluster, finds hidden attacks and update memory detector set in time. The experimental results show that the dynamic clonal selection algorithm with clustering analysis can enhance the detection system's ability to discover unknown intrusions.