Abstract: A method and apparatus for determining whether a user of a system is an authorized user or an imposter by examining the keystroke characteristics of the user. The authorized user initially enters a number of user training samples on a keyboard. The user training samples are then purified to eliminate training samples which are different from other training samples. The purification can be performed by a self-organizing neural network which has input thereto, authorized user training samples, or both authorized training samples and imposter training samples. The purified user training samples are then compared to a sample to be tested to determine whether the sample is from an authorized user or an imposter. The comparison of the purified samples with the sample to be tested can be performed by a neural network such as a back propagation trained network, an ADALINE unit, a distance method or a linear classifier, discriminate function, or piecewise linear classifier.