It calculates the times between the most recent 5 keystrokes and if they are too fast it carries out a configured action (logs the event or removes the device driver).