Keywords: Keystroke dynamics · Behavioral biometrics · Amharic ksystroke · · Continuous authentication · Ethiopic script
Behavioral biometrics authenticates or continuously verifies a user’s identity based on how an action is performed, rather than on static physiological traits (Abuhamad, Abusnaina, Nyang, & Mohaisen, 2021; Stylios, Kokolakis, Thanou, & Chatzis, 2021). Keystroke dynamics, which measures how long keys are held and the intervals between successive key events, is particularly attractive: it requires no special hardware, can be captured passively during ordinary typing, and supports both one-time login verification and continuous verification after login (Shadman et al., 2025). The field has advanced from distance-based and one-class anomaly detectors for short, fixed passwords (Killourhy & Maxion, 2009) to instance-based statistical matchers for free text (Ayotte, Banavar, Hou, & Schuckers, 2020) and deep sequence models, including recurrent networks trained with metric-learning losses (Acien, Morales, Monaco, Vera-Rodriguez, & Fierrez, 2022), Transformers (Stragapede, Delgado-Santos, et al., 2023, 2024), and hybrid recurrent–convolutional architectures with attention (González, Stragapede, Vera-Rodriguez, & Tolosana, 2025). These approaches have been evaluated on populations of up to hundreds of thousands of users.
Nevertheless, empirical evidence remains concentrated on English and other Latin-script languages typed on QWERTY layouts (Shadman et al., 2025). Widely used benchmarks—including the CMU fixed-password dataset (Killourhy & Maxion, 2009), the GREYC database (Giot, El-Abed, & Rosenberger, 2009), the Buffalo dataset (Sun, Ceker, & Upadhyaya, 2016), the Clarkson II corpus (described in Ayotte et al., 2020), and Aalto University typing data (Dhakal, Feit, Kristensson, & Oulasvirta, 2018)—which underpin recent large-scale benchmarks (Stragapede, Vera-Rodriguez, et al., 2024; Stragapede et al., 2025)—contain no non-Latin scripts. The few available multilingual studies suggest this is more than a cosmetic limitation: verification performance declines when enrollment and test languages differ (Wahab et al., 2022), and typing proficiency and consistency vary across a user’s languages and alphabets (Kang, 2015; Kim & Kang, 2020). Ge’ez-script (Ethiopic) languages are a pertinent but understudied case. Amharic, the Ethiopian federal government’s main working language, has more than 35 million native speakers and more than 25 million second-language speakers (Indiana University, n.d.), yet remains a low-resource language for language technology (Tonja et al., 2024; Yimam, Ayele, Venkatesh, Gashaw, & Biemann, 2021). Its script is an abugida: each character (fidel) represents a consonant–vowel syllable. It has 34 base consonants, each realized in seven vowel forms, plus labialized variants (Belay et al., 2020). On standard keyboards, users typically enter these characters through phonetic transliteration methods, where a syllable may require one or more Latin keystrokes (Microsoft, n.d.). These input methods create motor-planning, key-sequencing, and visual-search demands that differ from direct alphabetic typing. Only a purpose-built corpus can determine whether keystroke-timing biometrics generalize to this setting and whether models built on Latin-script assumptions apply.
A second gap concerns modality coverage within a single cohort. Researchers have typically examined fixed-text, free-text, and password-style typing separately, with different populations, protocols, and feature-extraction schemes, making cross-modality comparisons difficult (Shadman et al., 2025). Free-text data, in particular, exhibit greater intra-subject variability than fixed-text data because content, language, and the user’s state influence typing behavior (Acien et al., 2022; Stragapede, Delgado-Santos, et al., 2023). Wahab et al. (2022) released multi-keyboard, bilingual (English–Chinese) data to support more controlled comparisons, but such resources remain rare. Here, we provide a corpus in which participants from a shared pool contribute data across all three modalities, allowing us to examine how text constraints and content shape timing-feature distributions and user separability.
We address these gaps by introducing a multimodal keystroke dynamics corpus comprising five sub-corpora: Amharic fixed-text, English fixed-text, Amharic free-text, English free-text, and password text (Latin letters, digits, and symbols). We collected data from a shared pool of typists who self-reported their gender and typing skill. Rather than proposing a new classifier, we conduct a comprehensive exploratory data analysis (EDA) to examine the corpus’s structure, quality, and statistical properties before training any models. This step is often underreported in keystroke biometrics, even though data properties—including dataset size, per-user sample counts, and dependence between training and test samples—strongly influence reported performance (Kapoor & Narayanan, 2023; Wahab & Hou, 2023). In preliminary baseline experiments with the same cohort, standard classifiers achieved only 40–60% rank-1 accuracy and 10–20% Equal Error Rate (EER). These results are considerably worse than those reported for large, English-dominant free-text benchmarks, such as TypeNet’s 2.2% EER on physical keyboards (Acien et al., 2022) and the approximately 3.3% EER achieved by the best desktop systems in the KVC-onGoing challenge (Stragapede et al., 2025). Because protocols, data volumes, and populations differ, these figures are not directly comparable. Nevertheless, the gap motivates a careful diagnosis of the corpus itself.
The contributions of this work are as follows:
The remainder of the paper is organized as follows. Section 2 reviews related work on keystroke dynamics models, evaluation protocols, mobile and multimodal biometrics, the effects of language and script, benchmark datasets, and robustness, privacy, and fairness. Section 3 describes the data collection, feature schema, and EDA methodology, and Section 4 presents the EDA results. Section 5 discusses their implications for modeling and script-inclusive behavioral biometrics. Section 6 outlines limitations and threats to validity, and Section 7 concludes.
Recent research has largely moved from hand-crafted distance metrics to learned representations. Acien et al. (2022) trained LSTM networks (TypeNet) with softmax, contrastive, and triplet losses on the Aalto databases (about 168,000 desktop and 60,000 mobile users). They reported EERs of 2.2% and 9.2% for physical and touchscreen keyboards, respectively, with only a moderate increase in error when the test population grew to 100,000 subjects. Transformer-based models followed. Stragapede, Delgado-Santos, et al. (2023) introduced a Transformer for free-text mobile keystrokes, achieving a 3.84% EER with five enrollment sessions; TypeFormer lowered this to 3.25% using five enrollment sessions of 50 keystrokes each (Stragapede, Delgado-Santos, et al., 2024). Type2Branch combines parallel recurrent and convolutional branches with attention mechanisms and a set-based loss, achieving the lowest errors in the KVC-onGoing challenge (González et al., 2025). Metric-learning designs, which bring samples from the same user closer together and push samples from different users apart, are also attractive when only a few samples per user are available. For example, Lis, Niewiadomska-Szynkiewicz, and Dziewulska (2023) used a Siamese network with n-shot classification to verify users typing partial passwords. However, these advances have been demonstrated mainly on large Latin-script corpora. On smaller datasets, simple statistical methods can outperform deep models: Wahab and Hou (2023) reported EERs of 1.3% for instance-based tail area density (ITAD) and 4.3% for scaled Manhattan distance, compared with 19.18% for TypeNet, on a small dataset; TypeNet, however, performed better on two larger datasets. This finding is directly relevant to the present corpus, whose sub-corpora contain 34–183 users and have heavily tailed per-user sample counts (Section 4.7).
Free-text keystroke dynamics is more challenging than fixed-text analysis because content, vocabulary, and the user’s emotional and physical state influence typing rhythm, increasing intra-subject variability (Acien et al., 2022; Stragapede, Delgado-Santos, et al., 2023). Instance-based statistical approaches address this challenge by comparing individual digraph timings with a user profile. With 200 digraphs, ITAD achieved EERs of 7.8% on the uncontrolled Clarkson II corpus and 3.0% on the Buffalo dataset (Ayotte et al., 2020). Reported results also depend heavily on evaluation design. The Keystroke Verification Challenge (KVC) introduced a standardized protocol using tweet-length sequences from more than 185,000 subjects (Stragapede, Vera-Rodriguez, et al., 2024). Its latest version reported best EERs of about 3.33% for desktop and 3.61% for mobile (Stragapede et al., 2025). The winning system’s mean per-subject EERs (0.77% desktop and 1.03% mobile) rose to about 3.25% and 3.61%, respectively, when a single global decision threshold was applied (González et al., 2025). This illustrates how strongly reported error rates depend on threshold and averaging choices. Our analysis of per-user imbalance (Section 4.7) relates directly to these issues: it quantifies the heterogeneity of user contributions in the present corpus before any adaptation or calibration.
On smartphones, soft-keyboard timing is noisy, so researchers often combine keystroke features with touch, motion, and orientation signals, as in the HMOG feature set (Sitová et al., 2016). Kim and Kang (2020) combined keystroke and sensor features collected as participants typed free text in English and Korean, reporting EERs below 1% with a single reference set. Public mobile databases such as BehavePassDB, which records touchscreen and background-sensor data across several everyday tasks, now support standardized benchmarking (Stragapede, Vera-Rodriguez, Tolosana, & Morales, 2023). The associated MobileB2C competition showed that passive mobile authentication is feasible but remains challenging (Stragapede et al., 2022). Surveys of sensor-based and behavioral continuous authentication describe the range of fused modalities—including keystroke, touch, gait, motion, and voice—and persistent challenges in usability, performance, and adoption (Abuhamad et al., 2021; Stylios et al., 2021). The project from which the present data are derived (“Multimodal Biometric Fusion”) shares this long-term goal: its fixed-text, free-text, and password sub-corpora are designed to support the addition of other modalities in future work.
Evidence on the effects of language and script on keystroke biometrics is limited but consistent. Kang (2015) studied 83 Korean participants typing in Korean and English. They were more proficient but less consistent in Korean, their primary language and the alphabet they knew better. Which factor mattered most depended on whether authentication used only latencies or also key-sequence information. Wahab et al. (2022) collected bilingual data from 26 participants fluent in English and Chinese and found substantial cross-language degradation: enrolling in Chinese and testing in English raised the EER from 2% to 16%, while the reverse raised it from 3.3% to 9.7%. These findings suggest that keystroke templates are partly language-specific and that differences in users’ proficiency across languages shape timing distributions. The Ethiopic script presents an additional challenge. Amharic characters are syllabic: each of 34 base consonants has seven vowel forms, plus labialized forms (Belay et al., 2020). Phonetic input methods map each syllable to one or more Latin keystrokes, so the number of keystrokes per character varies (Microsoft, n.d.). Amharic is also under-resourced in language technology more broadly, although semantic models and multilingual language models for Ethiopian languages are beginning to emerge (Tonja et al., 2024; Yimam et al., 2021). To our knowledge, no previous keystroke dynamics study has examined typing in the Ethiopic script.
Progress in the field has been supported by public corpora, including the CMU fixed-password database (Killourhy & Maxion, 2009), the GREYC keystroke database (Giot et al., 2009), the Buffalo dataset (Sun et al., 2016), the Clarkson II corpus of uncontrolled free text (Ayotte et al., 2020), and Aalto University’s large-scale typing data (Dhakal et al., 2018). With data from more than 168,000 desktop participants, the Aalto collection underpins current deep-learning benchmarks (Acien et al., 2022; Stragapede, Vera-Rodriguez, et al., 2024). More recent releases include mobile multimodal data (Stragapede, Vera-Rodriguez, et al., 2023), multi-keyboard and bilingual English–Chinese data (Wahab et al., 2022), and the KeyRecs dataset, which includes fixed- and free-text samples from 100 participants representing 20 nationalities (Dias, Vitorino, Maia, Sousa, & Praça, 2023). A recent survey of keystroke datasets and algorithms identifies only a few multilingual collections, including the English–Korean FACT data (Kim & Kang, 2020) and English–Chinese bilingual data (Wahab et al., 2022), and finds no collections covering an Ethiopic script (Shadman et al., 2025). Table 1 places the present corpus alongside representative benchmarks.
| Dataset | Script / Language | Modality | Approx. users | Reported error regime |
| CMU Fixed-Password (Killourhy & Maxion, 2009) | Latin / English | Fixed-text (password) | 51 | \(\sim \)10% EER (classical distance metrics) |
| GREYC Keystroke (Giot et al., 2009) | Latin / English, French | Fixed-text (password) | 133 | \(\sim \)5–10% EER |
| Buffalo Free-Text (Sun et al., 2016) | Latin / English | Free-text | 148 | Session/day effects reported; EER varies widely |
| Clarkson II (see Ayotte et al., 2020) | Latin / English | Free-text (longitudinal) | 103 | Long-term drift documented |
| Aalto Typing (Dhakal et al., 2018) | Latin / English (web-scale) | Free-text | \(\sim \)168,000 | Large-scale rhythm statistics only |
| HMOG (Sitová et al., 2016) | Latin / English (mobile) | Fixed + free (touch fused) | 100 | Multimodal fusion reduces EER vs. keystroke alone |
| Present corpus | Ethiopic (Amharic) + Latin (English) | Fixed-text, free-text, password (same cohort) | 34–183 per sub-corpus | 40–60% accuracy / 10–20% EER (baseline, pre-optimization) |
Table 1 highlights two distinctive features of the present study: (i) to our knowledge, it is the first to include a language written in Ethiopic script, and (ii) it is among the few corpora to collect fixed-text, free-text, and password typing from the same participant pool, enabling cross-modality comparisons that are difficult with separately collected datasets. The error regimes listed in Table 1 were measured under heterogeneous protocols and are provided for context only, not for like-for-like comparison.
Beyond accuracy, recent work has also examined robustness, privacy, and fairness. Carefully designed adversarial attacks can target behavioral biometric models (Stylios et al., 2021), and synthetic keystroke timings generated from population- or user-specific statistics can substantially increase false acceptance rates in existing verifiers, underscoring the need for dedicated liveness detection (González, Calot, Ierache, & Hasperué, 2022). Typing data also reveal information beyond identity: keystroke features can classify users by age and gender (Tsimperidis, Yucel, & Katos, 2021), and mobile sensor and keystroke data can expose demographic, health, and behavioral attributes (Delgado-Santos et al., 2022). In the KVC benchmark, replacing key-content features with timing-only features preserved satisfactory performance while reducing privacy intrusion (Stragapede, Vera-Rodriguez, et al., 2024). Demographic bias is a recognized challenge across biometric modalities (Drozdowski, Rathgeb, Dantcheva, Damer, & Busch, 2020). For keystroke dynamics, KVC introduced the Skewed Impostor Ratio to quantify group-level bias (Stragapede, Vera-Rodriguez, et al., 2024), and the ongoing challenge found that verification scores reflect subjects’ age and gender to varying degrees (Stragapede et al., 2025). Our EDA reports gender and skill-level coverage for every sub-corpus (Section 4.3), enabling future fairness analyses of this corpus to account for subgroup composition.
We collected keystroke data from volunteer typists using a custom Android application that recorded key-press and key-release times to the nearest millisecond. During enrollment, participants reported their gender and typing proficiency (e.g., Novice, Intermediate, Advanced, or Expert). We labeled each submission with a session number and, for fixed-text tasks, with its prompt sentence. This design yielded five sub-corpora: fixed- and free-text entry modes in each of two languages (Amharic and English), plus a password-text sub-corpus typed with Latin letters, digits, and special symbols. Because user identifiers remain consistent across the data collection platform, the five sub-corpora are expected to contain overlapping but nonidentical participant groups, with 360–366 user IDs per sub-corpus. This enables the comparisons in Section 4.9.
Each sub-corpus row corresponds to a logged key event or an event-derived record and contains up to 25 fields: participant ID, session ID, self-assessed skillLevel and gender; the target Sentence and completeUserInput (in fixed-text sub-corpora only); a wall-clock Timestamp; the struck key’s text and type (keyText, keyType); per-event timings (flightTime, holdTime, interKeyTime, pressTime, and releaseTime); and engineered aggregates calculated at the session level and repeated on every row for that session: AverageKeyPressDuration, AverageKeyReleaseDuration, KeyPressVariability, KeyReleaseVariability, AverageInterkeyTime, KeyPressRate, KeyReleaseRate, AverageSeekTime, TypingSpeed, CharactersPerMinute, HoldFlightRatio, and FlightHoldRatio. Of these fields, 18 in fixed-text sub-corpora and 19 in free-text and password sub-corpora are numeric and were used in the quantitative EDA reported in Section 4. The latter sub-corpora lack a separate Sentence ID field and therefore include one additional numerically encoded field. Hold times and inter-key latencies are standard timing primitives in keystroke dynamics research (Shadman et al., 2025).
All analyses were conducted in Python 3. pandas and NumPy were used for data manipulation; seaborn and Matplotlib for statistical graphics; scikit-learn for standardization (StandardScaler), principal component analysis (PCA), and t-distributed stochastic neighbor embedding (t-SNE; van der Maaten & Hinton, 2008; default perplexity and a fixed random seed of 42); and umap-learn for uniform manifold approximation and projection (UMAP; McInnes, Healy, Saul, & Großberger, 2018; default parameters and a random seed of 42). The same procedure was applied independently to each of the five sub-corpora and covered: (1) structural analysis (shape, data types, and cardinality of users, sessions, and sentences); (2) a missing-value audit visualized using binary heatmaps; (3) identification of duplicate rows; (4) descriptive statistics for numeric variables (count, mean, standard deviation, and quartiles); (5) demographic and skill-level coverage; (6) univariate distributions of typing speed and three core timing primitives (hold time, flight time, and inter-key time); (7) boxplot-based screening of all numeric variables for outliers in each sub-corpus; (8) Pearson correlation matrices and cluster maps based on agglomerative clustering; (9) feature-level variation and skewness; (10) per-user aggregation of each numeric feature (mean and standard deviation) by participant id; (11) per-user sample and session distributions as indicators of data imbalance; (12) within-user stability (per-user standard deviation of hold time) and session-level variation (per-user mean hold time across sessions); (13) two- and three-dimensional projections of the standardized numeric feature space (PCA, t-SNE, and UMAP), colored by participant identity as an unsupervised proxy for user separability; and (14) keystroke-content analysis (key-frequency and key-type distributions) and comparison of typing speed between free and fixed text. Because t-SNE and UMAP emphasize local neighborhoods and do not reliably preserve global structure, and because two-dimensional embeddings of high-dimensional data inevitably introduce distortion, we interpret the projections in step (13) qualitatively rather than as quantitative measures of separability (Chari & Pachter, 2023; Wang, Huang, Rudin, & Shaposhnik, 2021).
Because several downstream analyses (PCA, t-SNE, UMAP, and correlation) are sensitive to missing values, missing numeric values were replaced with zero or the column mean. Identifier columns were excluded from projection and correlation analyses because they would trivially encode user identity in the feature space—a form of illegitimate-feature leakage (Kapoor & Narayanan, 2023). Zero-variance rows and columns were also removed before correlation-based clustering and dimensionality reduction. All figures in Section 4 follow this workflow and are presented as composite, multi-panel exhibits, with one panel per sub-corpus. Because imputation choices can affect correlation and projection results, we revisit this issue in Section 6.
The full dataset contains 114,955 keystroke-event rows across five sub-corpora (Table 2). English fixed-text is the largest, with 51,813 rows, 183 users, and 1,787 sessions. Amharic free-text is the smallest, with 4,751 rows, 34 users, and 239 sessions; this may be because composing unconstrained text in Amharic requires more effort. The fixed-text sub-corpora include few distinct prompt sentences (7 for Amharic and 13 for English), while the free-text and password sub-corpora have no fixed prompts.
| Sub-corpus | Language | Modality | Rows | Users | Sessions | Unique prompts | Numeric feat. |
| amharic_fixed | Amharic | Fixed-text | 18,684 | 95 | 918 | 7 | 18 |
| english_fixed | English | Fixed-text | 51,813 | 183 | 1,787 | 13 | 18 |
| amharic_free | Amharic | Free-text | 4,751 | 34 | 239 | n/a | 19 |
| english_free | English | Free-text | 20,417 | 75 | 612 | n/a | 19 |
| password | English (chars/ digits/ symbols) | Password-text | 19,290 | 121 | 1,165 | n/a | 19 |
| Total | — | — | 114,955 | 34–183\(^{a}\) | 4,721 | — | — |
Missing values are uncommon in the fixed-text sub-corpora (0.43–0.59% of all cells) but rise to 4.4–4.7% in the free-text and password sub-corpora (Table 3). This increase reflects two factors: flightTime and interKeyTime cannot be calculated for the first key in each sequence because it has no preceding key, and the free-text tasks lack an explicit Sentence field. Figure 1 shows binary heatmaps of missing-value locations in each sub-corpus. The structured (banded) pattern in several panels indicates that missingness is not randomly distributed across the data (i.e., it is not missing completely at random), with implications for imputation (Sections 5.2 and 6). Duplicate rows are very rare: 6–159 rows, or less than 0.4% of any sub-corpus.
| Sub-corpus | Rows | Users | Sessions | Missing cells | Missing (%) | Duplicate rows |
| amharic_fixed | 18,684 | 95 | 918 | 2,755 | 0.59 | 59 |
| english_fixed | 51,813 | 183 | 1,787 | 5,554 | 0.43 | 135 |
| amharic_free | 4,751 | 34 | 239 | 5,469 | 4.60 | 38 |
| english_free | 20,417 | 75 | 612 | 22,279 | 4.36 | 159 |
| password | 19,290 | 121 | 1,165 | 22,786 | 4.72 | 6 |
Figure 2 shows that a single self-reported gender predominates in each sub-corpus. Figure 3 shows that self-reported skill levels cluster toward the upper end of the scale, with relatively few novices. Both imbalances are relevant to subgroup fairness evaluation and to assessing whether classifiers perform equally well across subgroups (Section 2.6; Drozdowski et al., 2020). Exact subgroup counts are available in the outputs of our EDA pipeline.
Table 4 presents the mean and standard deviation for three key timing features—hold time, flight time, and inter-key time, measured in milliseconds—and typing speed, measured in characters per minute (CPM), across each sub-corpus. Two patterns stand out. First, typing speed varies substantially by modality and language. The password sub-corpus has the slowest average speed (33.9 CPM), likely because finding and entering digits and symbols takes extra effort, while English free-text is the fastest (98.6 CPM), in line with natural, fluent composition. Second, the timing features show very large standard deviations relative to their means: flight-time standard deviation exceeds the mean in all five sub-corpora, while inter-key-time standard deviation exceeds the mean in four of the five. The most extreme case is English fixed-text, where flight-time standard deviation is 9,962.6 ms, compared with a mean of 805.7 ms. Figures 4 and 5 show the corresponding distributions.
| Sub-corpus | Hold time (ms) | Flight time (ms) | Inter-key time (ms) | Typing speed (CPM) |
| amharic_fixed | 93.1 \(\pm \) 51.6 | 1,413.7 \(\pm \) 1,988.6 | 2,889.1 \(\pm \) 2,907.8 | 43.7 \(\pm \) 25.3 |
| english_fixed | 95.7 \(\pm \) 56.6 | 805.7 \(\pm \) 9,962.6 | 1,695.3 \(\pm \) 14,363.3 | 68.0 \(\pm \) 41.3 |
| amharic_free | 80.5 \(\pm \) 38.3 | 924.8 \(\pm \) 1,001.3 | 1,910.7 \(\pm \) 1,564.4 | 71.0 \(\pm \) 69.3 |
| english_free | 89.8 \(\pm \) 46.8 | 478.6 \(\pm \) 1,368.9 | 1,030.3 \(\pm \) 2,004.6 | 98.6 \(\pm \) 71.3 |
| password | 92.7 \(\pm \) 68.5 | 1,108.4 \(\pm \) 2,474.8 | 2,307.2 \(\pm \) 3,491.8 | 33.9 \(\pm \) 15.4 |
Cross-sub-corpus boxplots (Figure 6) of hold time, flight time, and typing speed confirm the heavy tails indicated in Table 4. Each feature has a narrow interquartile range and numerous outliers several interquartile ranges above the upper quartile. Some flight-time and inter-key-time values are also negative; we attribute these to clock-skew artifacts rather than genuine negative intervals (see Section 6 for an alternative explanation). We retained these points in the summary statistics instead of silently discarding them for two reasons: (a) long pauses may reflect genuine cognitive or motor events of interest, and (b) any trimming decision should be made transparently during modeling, not embedded in a shared EDA result. We flag the negative values for resolution during data cleaning.
The Pearson correlation heatmaps (Figure 7) and hierarchically clustered correlation maps (Figure 8) indicate that several engineered features are algebraically or nearly algebraically redundant with the raw features used to derive them. Across all sub-corpora, holdTime correlates perfectly or almost perfectly with AverageKeyPressDuration, while flightTime is strongly correlated with AverageInterkeyTime. AverageSeekTime is also strongly correlated with AverageKeyReleaseDuration, as these session-level aggregates are recalculated for each row in a session. KeyPressRate and KeyReleaseRate are likewise redundant across all five sub-corpora. As a result, the nominal 18–19 numeric columns represent far fewer independent degrees of freedom; the cluster maps suggest approximately 8–10 per sub-corpus.
Table 5 summarizes the number of samples each user contributed to each sub-corpus. All sub-corpora are strongly right-skewed: median contributions (46–103 samples per user) are well below the means (139.7–283.1), while maxima (722–5,145) are roughly 13 to 65 times the corresponding medians. English free-text is the most imbalanced, with a coefficient of variation (SD/mean) of 2.43, suggesting that a small number of highly active users provide a large share of the training signal. Figure 9 illustrates this pattern. Although common in behavioral-biometric field data, this imbalance is seldom acknowledged. It poses specific challenges for closed-set user identification, where over-represented users are easier to learn, while macro-averaged accuracy declines for under-represented users. It also affects open-set user verification, where over-represented users dominate EER estimates unless user- or session-level weighting is applied. Recent benchmarks show that reported EERs depend on per-subject versus global thresholding (González et al., 2025), underscoring the need to make these choices explicit.
| Sub-corpus | Users (\(n\)) | Mean | SD | Min | Median | Max | CV (SD/mean) |
| amharic_fixed | 95 | 196.7 | 298.6 | 12 | 49.0 | 1,526 | 1.52 |
| english_fixed | 183 | 283.1 | 438.0 | 9 | 103.0 | 2,562 | 1.55 |
| amharic_free | 34 | 139.7 | 199.9 | 6 | 53.5 | 722 | 1.43 |
| english_free | 75 | 272.2 | 662.2 | 4 | 79.0 | 5,145 | 2.43 |
| password | 121 | 159.4 | 317.1 | 13 | 46.0 | 1,673 | 1.99 |
To assess user separability in the standardized timing-feature space before supervised training, we projected each sub-corpus using PCA (linear; Figure 10), t-SNE (nonlinear and focused on local structure; Figure 11), and UMAP (nonlinear and designed to balance local and global structure; Figure 12). Points are colored by participant identity. Across all three methods and all five sub-corpora, participants overlap substantially. No sub-corpus shows compact, well-separated user clusters that would suggest near-perfect classification from this feature space. The PCA projections form a single, diffuse, largely unimodal cloud, suggesting that the first two principal components capture task-level variation (e.g., overall speed) rather than user-discriminative structure. These results are consistent with, and may help explain, the baseline classifiers’ previously obtained rank-1 accuracy of 40–60% and EER of 10–20% on this cohort. If three complementary projections of the 18–19-dimensional feature space reveal no clear user structure, near-perfect discrimination should not be expected from downstream classifiers using the same features without enrichment (e.g., sequence- or digraph-level representations) or session- and user-level adaptation. Because two-dimensional embeddings distort high-dimensional neighborhoods (Chari & Pachter, 2023; Wang et al., 2021), this evidence is qualitative and should be complemented by quantitative separability measures in future work.
Figure 13 compares typing-speed distributions across the pooled fixed-text and free-text sub-corpora, focusing on the two text-constraint modes. As expected, free-text entry has a higher median speed and greater variability, since typing alternates between fluent production and pauses for composition. This pattern aligns with the heavy upper tail in the flight-time distributions observed in Section 4.4, while fixed-text entry, which uses short prompts typed repeatedly, produces a tighter speed distribution.
Finally, Figures 14 and 15 profile raw key-level content across each sub-corpus. Key-type distributions (Figure 14) are dominated by alphabetic and character keys in all sub-corpora, while the password sub-corpus shifts markedly toward digit and symbol keys, consistent with common password-composition requirements. The top-30 key-frequency distributions (Figure 15) show that the Amharic sub-corpora use a broad range of fidel characters (correctly rendered with Ethiopic fonts), whereas the English sub-corpora concentrate most of their frequency mass on a few high-frequency Latin characters. This difference in symbol-space size and frequency structure is an important explanatory factor. We propose that future models capture it explicitly, for example, through key-identity embeddings of the kind used alongside timing features in recent deep keystroke models (Acien et al., 2022; Stragapede, Vera-Rodriguez, et al., 2024).
Taken together, four EDA findings offer a coherent, testable explanation for the baseline results on this corpus: 40–60% accuracy and 10–20% EER. First, the extreme right skew and outlier-driven variance in flight and inter-key times (Sections 4.4–4.5) mean that naive mean- and variance-based features are dominated by rare events and do not represent a user’s typical rhythm well. Second, algebraic redundancy among engineered features (Section 4.6) indicates that the feature space’s effective dimensionality is far below its nominal 18–19 columns, leaving models with fewer independent discriminative features. Third, the heavy-tailed distribution of per-user sample counts (Section 4.7) causes empirical-risk-minimization learners to fit a few prolific users at the expense of macro-averaged performance. Fourth, and most directly related to the classification ceiling, substantial overlap among users in PCA, t-SNE, and UMAP (Section 4.8) suggests that the row-level timing representation analyzed here is not sufficiently user-discriminative on its own. These factors interact with corpus scale: with 34–183 users per sub-corpus and few samples for many users, the current data fall into a regime where data-hungry deep models may underperform simpler statistical matchers (Wahab & Hou, 2023), unlike the large Aalto-based benchmarks on which deep models excel (Acien et al., 2022; Stragapede et al., 2025). Language and script effects may add further variability, given the cross-language degradation reported for bilingual typists (Wahab et al., 2022).
Building on this diagnosis and the literature reviewed in Section 2, we identify six priorities for future modeling with this corpus. (1) Move beyond row-level and session-aggregate features toward sequence-level representations, such as per-session digraph and trigraph sequences processed by recurrent, convolutional, or attention-based encoders (Acien et al., 2022; González et al., 2025; Stragapede, Delgado-Santos, et al., 2024). The redundancy analysis suggests that current aggregate features provide little independent information. (2) Replace random row-level splits with session- and user-disjoint training, validation, and test partitions. Since rows from the same session share recomputed aggregates, random splits would leak these features across partitions. Dependence between training and test samples is also a well-documented source of inflated performance (Kapoor & Narayanan, 2023). Standardized protocols such as KVC offer a model for organizing fair comparisons (Stragapede, Vera-Rodriguez, et al., 2024). (3) Use outlier-robust statistics, such as median- and MAD-based normalization, or model long pauses explicitly as separate features, since outliers contribute substantially to variance (Section 4.5). Treat imputation as an explicit modeling decision, because missingness is structured rather than random (Section 4.2). (4) Use methods suited to the small and uneven number of samples per user, such as metric-learning embeddings trained with contrastive, triplet, or Siamese objectives (Acien et al., 2022; Lis et al., 2023), as well as instance-based statistical matchers such as ITAD (Ayotte et al., 2020), which can match or outperform deep models on small datasets (Wahab & Hou, 2023). (5) Encode key identity and script information explicitly (Section 4.10), rather than pooling Amharic and English rows in a single feature space, given their different symbol spaces and timing distributions, as well as the cross-language degradation reported for bilingual typists (Wahab et al., 2022). When privacy is a concern, timing-only features offer a less invasive alternative (Stragapede, Vera-Rodriguez, et al., 2024). (6) Report error rates using explicit threshold policies (per-user versus global) and disaggregate them by gender and skill level, because aggregate EERs can conceal threshold effects (González et al., 2025) and demographic differentials (Drozdowski et al., 2020; Stragapede et al., 2025).
Beyond these modeling recommendations, the corpus’s broader contribution is evidential: it demonstrates that a complete, standard keystroke-dynamics EDA and baseline workflow can be applied to a language written in the Ethiopic script. The overall findings—skewed timing distributions, redundant engineered features, imbalanced user contributions, and overlapping user manifolds—are consistent with challenges widely reported for free-text keystroke data in Latin-script corpora, including high intra-subject variability and sensitivity to text content (Acien et al., 2022; Shadman et al., 2025), although the performance ceiling observed here is lower. The English sub-corpora provide an internal reference processed with identical features, but comparisons with external Latin-script corpora remain qualitative because their features and protocols differ. These results suggest that the methodological toolkit developed for Latin-script keystroke dynamics is a reasonable starting point for non-Latin scripts. However, they also show that dataset-specific diagnostics, such as those presented here, are needed before generalizing, particularly given evidence that language and alphabet affect keystroke templates (Kang, 2015; Wahab et al., 2022) and the broader under-representation of Ethiopian languages in language technology (Tonja et al., 2024; Yimam et al., 2021).
Several limitations qualify these conclusions. First, participants self-reported their gender and skill levels, which we did not independently verify. Thus, the subgroup differences discussed in Section 4.3 may reflect this sample rather than the broader population of Amharic and English typists. Second, although overlapping identifier ranges suggest the five sub-corpora came from a largely shared pool, no explicit linkage table was available. Therefore, treat the comparisons in Section 4.9 as suggestive, not as a fully controlled within-subject design. Third, the negative and otherwise implausible timing values reported in Section 4.5 point to logging artifacts that should be cleaned before high-stakes model training. However, if flight time is defined as the interval from releasing one key to pressing the next, some negative values may reflect genuine key overlap (rollover), not clock skew. We should distinguish these cases during cleaning. Fourth, the dimensionality-reduction analysis in Section 4.8 is graphical and qualitative. We did not compute quantitative cluster-separation measures (e.g., silhouette scores) to avoid implying more precision than the EDA supports, and two-dimensional embeddings are known to distort high-dimensional structure (Chari & Pachter, 2023). Fifth, missing values were replaced with zeros or column means before the correlation and projection analyses (Section 3.4), which may attenuate or distort some correlations. Sixth, the data schema does not describe the Amharic text-entry method (e.g., the specific transliteration input method or keyboard layout), limiting interpretation of Amharic timing features. Finally, this paper presents EDA and baseline characterization, not new classifier results. The 40–60% accuracy and 10–20% EER values cited throughout come from earlier baseline experiments on this cohort that are not reported in detail here. Comparisons with error rates published for other corpora are also not like-for-like because datasets, protocols, and metrics differ.
We developed and characterized a multimodal, bilingual keystroke dynamics corpus covering fixed-text, free-text, and password modalities in Amharic and English. Data were collected from a shared participant pool, with 34–183 participants per sub-corpus, and comprise 114,955 labeled keystroke events. To the best of our knowledge, this is the first comprehensive keystroke dynamics corpus to include an Ethiopic-script language, addressing a gap in behavioral biometrics research dominated by Latin-script and English-language data. Our EDA pipeline examines corpus structure, data quality, demographics, univariate and bivariate timing distributions, feature redundancy, per-user imbalance, and separability using PCA, t-SNE, and UMAP. It generates reproducible diagnostics that help explain baseline classifier performance and inform the modeling recommendations in Section 5.2. Future work should (i) develop and evaluate sequence-level, session-aware, and few-shot models using session- and user-disjoint protocols, as outlined in Section 5.2; (ii) extend the corpus with additional behavioral modalities (touch, mouse, and gaze), following the original collection’s multimodal fusion rationale; (iii) expand the participant pool and improve gender and proficiency balance; (iv) document the Amharic input method and add quantitative separability and fairness analyses; and (v) broaden script coverage to include other under-represented writing systems, creating more representative behavioral-biometric benchmarks.
The complete keystroke dynamics dataset supporting the findings of this study is publicly available at https://github.com/animawkerie/BahriApp-Dataset. The exploratory data analysis workflow is implemented in a standalone Jupyter notebook, which is available from the corresponding author upon reasonable request, subject to participant confidentiality and institutional data-sharing rules.
Conflict of interest: Authors have no conflicts of interest to declare.
Ethical considerations: The study was conducted as part of the corresponding author’s doctoral research and received approval from the Addis Ababa Science and Technology University Institutional Ethical Approval Board (AASTU-IEAB) under form number RTT/RCD/OF/0028. All data-handling procedures followed the approved protocol and Ethiopia’s Personal Data Protection Proclamation No. 1321/2024. Participation was voluntary and limited to adults, so guardian consent was not required. Before data capture, the mobile data collection application informed each participant of the study’s purpose, the behavioral data to be recorded, the plan to publicly release anonymized data, and their right to withdraw at any time. Participants then consented to take part and share their data through an explicit in-app confirmation.
The protocol permitted anonymous collection only. The released files stored no names, contact details, national or institutional identification numbers, or facial images. Instead, each participant is represented by a random numeric identifier, which is the only key linking records across sessions and modalities. The only personal attributes retained are self-reported gender and typing-skill level. We captured data using version 1.0.0 of the BahriApp custom-developed mobile application. Because behavioral signals can support re-identification, the released files contain no direct identifiers, and a Data Usage Agreement governs reuse and prohibits any attempt to re-identify participants.