Network-based and distributed intrusion detection system is aroused by the burst-outs of large-scale abnormal events. How to place detection instruments is the key to the detections. The paper turned the problem of detector placement to that of the clustering of topology graph. A novel Bidirectional Hierarchical Clustering algorithm is put forward, which decreases the amount of result clusters by integration of initial marker selection method based on node out-degree. The simulation results demonstrate that our clustering approaches effectively by comparison on the three evaluations metric, Diameter Stability, Average Advantage Ratio and Average Coefficient of Variation.