Abstract: Apparatus and methods are described for detecting sharing of electronic or online accounts based on grouping of data samples that include keyboard input timing factors and optionally secondary factors. The data samples can be received from various computers having various keyboards of a certain type and may be input by more than one user. The data samples are grouped based on distances and ratios of mathematical combinations of distances between input timing of key events such as dwell and flight time, as well as optionally based on at least one secondary factor related to the keyboard input timing factors. Example secondary factors include a time of day of the input; and/or a machine identification, location, and IP address of the computer used to input the sample.

Abstract: Apparatus and methods are described for detecting sharing of electronic or online accounts based on grouping of data samples that include keyboard input timing factors and optionally secondary factors. The data samples can be received from various computers having various keyboards of a certain type and may be input by more than one user. The data samples are grouped based on distances and ratios of mathematical combinations of distances between input timing of key events such as dwell and flight time, as well as optionally based on at least one secondary factor related to the keyboard input timing factors. Example secondary factors include a time of day of the input; and/or a machine identification, location, and IP address of the computer used to input the sample.