1. A computer implemented method for detecting intruders into a computer comprising: capturing historical data input into the computer by a user during a training mode; profiling the historical data during the training mode to identify normal behavior; capturing test data input by the user into the computer during an operational mode; comparing the test data with the profiled historical data in accordance with a predetermined similarity metric during the operational mode to produce similarity results; and, evaluating the similarity results during the operational mode to identify abnormal data.