For long-text-input of about 650 strokes, a keystroke biometric system was developed for applications such as identifying perpetrators of inappropriate email or fraudulent Internet activity. A Java applet collected raw keystroke data over the Internet, appropriate long-text-input features were extracted, and a nearest neighbor classifier made identification decisions. Experiments were conducted on a total of 118 subjects using two input modes--copy and free-text input--and two keyboard types--desktop and laptop keyboards. Primary results indicate that the keystroke biometric can accurately identify an individual who sends inappropriate email (free text) if sufficient enrollment samples are available and if the same type of keyboard is used to produce the enrollment and questioned samples. For laptop keyboards 99.5% accuracy on 36 users was obtained, which decreased to 97.9% on a larger population of 47 users. For desktop keyboards 98.3% accuracy on 36 users was obtained, which decreased to 93.3% on a larger population of 93 users. Accuracy decreases significantly when subjects used different keyboard types or different input modes for enrollment and testing. Secondary results concerned the optimization of system parameters such as the number of outlier removal passes, the outlier distance threshold, and the minimum number of occurrences of a key-press or transition before resorting to fall-back options in calculating the statistical features. Additional important findings were minimum number of entries per subject should be at least three and the identification accuracy as a function of input text length levels off at 200-300 characters for copy mode of entry and 500 for free-text mode of entry.
