A dictionary is a collection of keywords or key phrases where each entry is assigned a score. Sensitive content is compared to the dictionary entries and ranked according to the score.
Content classification and content fingerprinting criteria use specified dictionaries to classify a document if a defined threshold (total score) is exceeded — that is, if enough words from the dictionary appear in the document. The assigned scores can be negative or positive, allowing you to look for words or phrases in the presence of other words or phrases.
The difference between a dictionary and a string in a keyword definition is the assigned score.
A keyword classification always tags the document if the phrase is present.
A dictionary classification gives you more flexibility because you can set a threshold when you apply the definition, making the classification relative. The threshold can be up to 1000. You can also choose how matches are counted: Count multiple occurrences increases the count with each match, Count each match string only one time counts how many dictionary entries match the document.
Trellix DLP software includes several built-in dictionaries with terms commonly used in health, banking, finance, and other industries. You can also create your own dictionaries and edit them manually or copy and paste from other documents.
Limitations
There are some limitations to using dictionaries. Dictionaries are saved in Unicode (UTF-8) and can be written in any language. The following descriptions apply to dictionaries written in English. The descriptions generally apply to other languages, but there might be unforeseen problems in certain languages.
Dictionary matching has these characteristics:
It is only case sensitive when you create case-sensitive dictionary entries. Built-in dictionaries, created before this feature was available, are not case sensitive.
It can optionally match substrings or whole phrases.
It matches phrases including spaces.
If substring matching is specified, be careful when entering short words because of the potential for false positives. For example, a dictionary entry of "cat" would flag "cataracts" and "duplicate." To prevent these false positives, use the whole phrase matching option, or use statistically improbable phrases (SIPs) to give the best results. Similar entries are another source of false positives. For example, in some HIPAA disease lists, both "celiac" and "celiac disease" appear as separate entries. If the second term appears in a document and substring matching is specified, it produces two hits (one for each entry) and skews the total score.