This master’s thesis work was performed at Optimum Biometric Labs, OBL, located in Karlskrona, Sweden. Optimum Biometric Labs perform independent scenario evaluations to companies who develop biometric devices. The company has a product Optimum preConTM which is surveillance and diagnosis tool for biometric systems. This thesis work’s objective was to develop a conceptual model and implement it as an additional layer above the biometric layer with intelligence about the biometric users. The layer is influenced by the general procedure of biometrics in a multimodal behavioural way. It is working in an unsupervised way and performs in an unsupervised manner. While biometric systems are increasingly adopted the technologies have some inherent problems such as false match and false non-match. In practice, a rejected user can not be interpreted as an impostor since the user simply might have problems using his/her biometric feature. The proposed methods in this project are dealing with these problems when analysing biometric usage in runtime. Another fact which may give rise to false rejections is template aging; a phenomenon where the enrolled user’s template is too old compared towards the user’s current biometric feature. A theoretical approach of template aging was known; however since the analysis of template aging detection was correlated with potential system flaws such as device defects or human generated risks such as impostor attacks this task would become difficult to solve in an unsupervised system but when ignoring the definition of template aging, the detection of similar effects was possible. One of the objectives of this project was to detect template aging in a predictive sense; this task failed to be carried out because the absence of basis performing this kind of tasks. The developed program performs abnormality detection at each incoming event from a biometric system. Each verification attempt is assumed to be from a genuine user unless any deviation according to the user's history is found, an abnormality. The possibility of an impostor attack depends on the degree of the abnormality. The application makes relative decisions between fraud possibilities or if genuine user was the source of what caused the deviations. This is presented as an alarm with the degree of impostor possibility. This intelligent layer has increased Optimum preCon´s capacity as a surveillance tool for biometrics. This product is an efficient complement to biometric systems in a steady up-going worldwide market.