A rule management system and methods are disclosed. A rule management system includes a processor and an interface for receiving data comprising a plurality of data fields. The processor includes in a data structure nodes corresponding to combinations of first and second data field values. The data structure includes a node for each combination of first and second data field values for which there exists at least one rule and does not include at least one node corresponding to at least one combination of first and second data field values for which there does not exist a rule. The processor associates rules with each node of the data structure. A node and an associated set of rules for processing a data packet may be identified by determining first and second indices into the data structure that correspond to first and second data field values of the received data packet.