1. A method comprising: in a processor, building a decision tree structure including a plurality of nodes, each node representing a subset of a plurality of rules having at least one field; for at least one node of the decision tree structure, determining a number of cuts that may be made on each at least one field creating child nodes equal to the number of cuts and selecting a field on which to cut the at least one node based on a comparison of an average of a difference between an average number of rules per child node created and an actual number of rules per child node created per each at least one field; cutting the at least one node into a number of child nodes on the selected field; and storing the decision tree structure in a memory, wherein selecting the field on which to cut the at least one node based on the comparison enables the processor to build a wider, shallower decision tree structure relative to selecting the field on which to cut not based on the comparison, reducing a search time of a search performed using the decision tree structure stored in the memory.