Machine learning

Administrator Help | Forcepoint DLP | Version 8.6.x

Machine learning classifiers are an advanced tool that allows administrators to provide examples of the type of data to protect and not to protect. This allows Forcepoint DLP to learn to identify sensitive data in traffic.

The examples of what to protect are called positive training sets.

The examples of what not to protect are called negative training sets.

Together, these examples educate the system.

Unlike fingerprinting, the files do not need to contain parts of the actual files to protect, but can instead look similar or cover a similar topic. The system learns and recognizes complex patterns and relationships and makes decisions without the exact include/exclude criteria specified in fingerprinting classifiers. Machine learning can even protect new, zero-day documents in this way.

Because machine learning classifiers are not looking for an exact match, they can handle a larger number of files than fingerprinting classifiers.


	Note Machine learning classifiers can be used for unstructured file system data only. They cannot be used for database data or unstructured SharePoint or IBM Domino data.

After creating a classifier, the system assesses the expected number of unintended matches (false positives) and undetected content (false negatives) and provides an accuracy level.

The system supports 3 levels of machine learning classifiers:

Explicit negative examples, such as non-proprietary marketing plans as a negative example to propriety marketing plans

Non-explicit negative examples, such as directories that do not contain marketing plans as negative examples to directories with proprietary marketing plan

Positive examples

For tips and best practices for using machine learning, refer to Introduction to Machine Learning for Forcepoint DLP.

Creating a machine learning classifier

Create a machine learning classifier on the Main > Policy Management > Content Classifiers > Machine Learning page in the Data Security module of the Forcepoint Security Manager.

The Machine Learning page lists the existing machine learning classifiers.

Expand the right pane to view more details, such as last run time, or collapse it to show fewer.

Click the links in the details pane to adjust classifier settings or view more details.

Start, stop, or pause a machine learning process using buttons on the toolbar at the top of the content pane.

To create the classifier, click New in the toolbar at the top of the content pane. A wizard opens. See Machine Learning Wizard - General.