Definition
Vector Machine Learning (VML) in Symantec DLP refers to trained classifiers that learn to recognize categories of sensitive content from sample data. VML is used for categories where DCM is too noisy and EDM/IDM don't fit - for example, "any source code" (versus fingerprinting specific files), "any design specification," "any legal contract." Training takes 100-500 sample documents per category; classification accuracy depends on training set quality. VML complements rather than replaces the other detection engines: DCM for pattern-based, EDM for structured-data exact matching, IDM for document fingerprinting, VML for categorical classification.
Symantec products that implement this
- Symantec Data Loss Prevention - Discover, monitor, and protect sensitive data across endpoints, network, storage, cloud, and email - the most comprehensive enterprise DLP platform on the market.
Related terms
- DLP (Data Loss Prevention) - Security capability that discovers, monitors, and protects sensitive data across endpoints, networks, storage, cloud, and email.
- EDM (Exact Data Matching) - DLP detection technique that fingerprints structured data sources (databases, CSV exports) and detects exact matches in outbound content.
- IDM (Indexed Document Matching) - DLP detection technique that fingerprints unstructured documents and detects when copies or substantial portions appear elsewhere.
- DCM (Described Content Matching) - DLP detection technique using regex patterns, dictionaries, and keywords - fast but high false-positive rate.
Deep-dives on VML
- Symantec DLP deployment checklist: 14 things to do before you turn it on - The deployment-readiness checklist nobody publishes - what to settle before the first policy fires. Detection engines, fingerprinting, incid…
- Implementing EDM and IDM in Symantec DLP: fingerprinting that actually works - EDM and IDM are what separate Symantec DLP from cheaper alternatives - and the most under-budgeted parts of every DLP project we see. A prac…