Machine learning details

Administrator Help | Forcepoint DLP | Version 8.5.x

For machine learning classifiers, the Active Classifier section of the details pane shows the following information:

Statistic

Description

Accuracy

Expected rate of unintended and undetected matches (false positives and false negatives).

Last successful scan time

The time and date of the last successful scan

All documents folder

Path to the all documents folder

Positive examples folder

Path to the positive examples folder

Negative examples folder

Path to the negative examples folder

Sensitivity

How sensitive the classifier is when detecting matches—in other words, how closely content has to match the positive examples to be considered an incident.

Wide is highly sensitive and errs on the restrictive side. To avoid leaking sensitive data, it is more likely to produce a false positive (unintended match) than a false negative (content that is not detected).

Default balances the number of false positives and false negatives.

Narrow is the least restrictive. It is more likely to let content through than to produce an unintended match.

Click the link to adjust the sensitivity level. Your choice depends on how important it is to prevent sensitive data loss.

Ignore inconsistent examples

Indicates whether to ignore documents that do not appear to belong to the positive examples folder or to use them as positive examples anyway.

To view a list of inconsistent example documents, download the Machine Learning report.

To keep the machine learning classifier up to date, periodically rescan the examples folders. The Current Scan Statistics section of the details pane shows information about the latest scan. If the scan succeeds, it becomes the active classifier. If it fails, the Active Classifier and Current Scan Statistics are different.


Statistic	Description
Run time	The time and date that the machine learning process last ran
Status	The status of the current content scan. See Machine learning current scan status options for an explanation of each status option. The status shown in the details pane may be different from the status shown in the Status column of the table if you click Refresh in one area but not the other.
All documents folder	Path to the all documents folder
All my documents	Number of documents in the all documents folder
Positive examples folder	Path to the positive examples folder
Positive examples	Number of documents in the positive examples folder
Negative examples folder	Path to the negative examples folder
Negative examples	Number of documents in the negative examples folder
Total scanned files	Total number of documents that were scanned
Accuracy	Expected rate of unintended and undetected matches (false positives and false negatives).

Machine learning current scan status options

Possible statuses include:

Pre-processing (n files) - The system is locating and counting all the files in the positive example files, negative example files, and all documents folder.

Processing (x%) - The system is processing files in the sample set. The percentage shows the progress made on the total number of files.

Training (x%) - The system is applying algorithms and learning from your positive, negative, and all-documents sample sets.

Reprocessing (x%) - The system is reprocessing files or in the case of large sample sets, processing additional files. The percentage shows the progress made on the total number of files.

Retraining (x%) - The system is applying algorithms to learn from the new or broader scan.

Completed - The current scan succeeded and has become an active classifier that you can use.

Completed with warnings - The current scan succeeded and has become an active classifier that you can use, but there were a few warnings that you might want to address. To view the warnings, click More Actions and download the machine learning report.

Failed - The scan could not be completed and the classifier cannot be used. To view the errors that were encountered, click More Actions and download the machine learning report.

Paused - The scan was manually paused using the toolbar button.

Stopped - The scan was manually stopped using the toolbar button.