A computer system implemented method of updating rules for identifying transactions, the method comprising: monitoring communications between clients and applications that process transactions, the transactions including patterns; applying rules to identify which transactions are processed by the applications, the rules are organized based on frequencies with which the patterns are expected to appear in the transactions and based on frequencies with which each of the transactions is expected to be processed by the applications, applying the rules is based on the organization, wherein the rules are applied using a data structure including a tree having nodes (130a, 130b, 130c, 130d, 130e; 830a, 830b, 830c, 830d, 830e), including a root node (130a; 830a), leaf nodes (130c, 130d, 130e; 830c, 830d, 830e), and branches that can be taken to traverse the tree from the root node (130a; 830a) to one of the leaf nodes (130c,130d,130e; 830c, 830d, 830e), wherein the nodes (130a, 130b, 130c, 130d, 130e; 830a, 830b, 830c, 830d, 830e) of the tree either: i) each comprise one or more patterns based on parameters; or ii) each comprise one or more patterns based on strings, including traversing the tree from the root node (130a; 830a) to one of the leaf nodes (130c,130d,130e; 830c, 830d, 830e) by taking branches based on whether patterns identified in the transactions match the patterns of the nodes (130a, 130b, 130c, 130d, 130e; 830a, 830b, 830c, 830d, 830e); analyzing the communications, the analyzing comprises determining the frequency with which each of the transactions is identified and determining the frequency with which each of the patterns appears in the transactions; and updating the organization of the rules based on the frequency with which each of the patterns appears in the transactions including placing patterns that occur with a greater frequency closer to the root (130a; 830a) of the tree. monitoring communications between clients and applications that process transactions, the transactions including patterns; applying rules to identify which transactions are processed by the applications, the rules are organized based on frequencies with which the patterns are expected to appear in the transactions and based on frequencies with which each of the transactions is expected to be processed by the applications, applying the rules is based on the organization, wherein the rules are applied using a data structure including a tree having nodes (130a, 130b, 130c, 130d, 130e; 830a, 830b, 830c, 830d, 830e), including a root node (130a; 830a), leaf nodes (130c, 130d, 130e; 830c, 830d, 830e), and branches that can be taken to traverse the tree from the root node (130a; 830a) to one of the leaf nodes (130c,130d,130e; 830c, 830d, 830e), wherein the nodes (130a, 130b, 130c, 130d, 130e; 830a, 830b, 830c, 830d, 830e) of the tree either: i) each comprise one or more patterns based on parameters; or ii) each comprise one or more patterns based on strings, including traversing the tree from the root node (130a; 830a) to one of the leaf nodes (130c,130d,130e; 830c, 830d, 830e) by taking branches based on whether patterns identified in the transactions match the patterns of the nodes (130a, 130b, 130c, 130d, 130e; 830a, 830b, 830c, 830d, 830e); analyzing the communications, the analyzing comprises determining the frequency with which each of the transactions is identified and determining the frequency with which each of the patterns appears in the transactions; and updating the organization of the rules based on the frequency with which each of the patterns appears in the transactions including placing patterns that occur with a greater frequency closer to the root (130a; 830a) of the tree.