1. A method comprising: in a processor, building a decision tree structure including a plurality of nodes, each node representing a subset of a plurality of rules having at least one field; and for at least one node of the decision tree, determining a number of cuts that may be made on each at least one field creating child nodes equal to the number of cuts and selecting a field on which to cut the at least one node based on a comparison of an average of a difference between an average number of rules per child node created and an actual number of rules per child node created per each at least one field.