This is difficult because you can run a hybrid spec that gets two spec-defining abilities that are from two seperate trees.
For example am I a shadow priest if I have mind flay and Vamp Embrace even if I also have Spirit of redemption from the holy tree?
Using Priest as an example, Shadow form, Light Well and Power Infusion are definitely going to be triggers for shadow, holy and disc respectively. For holy/disc I almost say it should just be listed as “healing priest” over a specific spec. Because the only way to truely know if you’re disc or holy is whether you run power infusion or light well and tbh a lot of holy priests will simply not run light well. There will be several “holy” priests that go deep enough into disc to get divine spirit as well. But they will still have more points in the holy tree than in disc. Are you able to detect how many points are spent in each tree? For example if you can detect that a priest is 21/30/0 you can call them holy but if they are 26/25/0 they would be discipline.
(1) Determine healing by just seeing if they heal more during a fight than dps. That just gets you marked as “healer”.
(2) Don’t try to differentiate types of DPS within a class. Just lump them all together.
(3) Tanking. This is the trickiest one. For warrior maybe examine uses of shield-requiring abilities and require that to be over a certain threshold?
Tracking blocks in addition to shield abilities might be helpful. You never know when you’ll get one of those tanks that doesn’t use their abilities. For druids are you able to parse the the duration of buffs and trigger a spec off of that? For example if a druid has the bear form buff up longer they’ll parse as tank
Would using the amount of incoming damage or damage taken help at all? Or maybe be used as an additional deciding factor? Amount of healing taken?
I’m only really familiar with Druids, but as Zolvolt suggested, tracking the different roles based on time spent in a specific form might be the quickest way of differentiating between them. That could pose a problem if you have an off-tank that swaps to cat form or caster form once their target is dead, though.
Otherwise, bears will primarily use Maul, Swipe, Faerie Fire Feral, and, when possible, Growl.
One potential problem with #3 is that warriors use more non-traditional specs now like Fury/Prot and dual wield Fury/Prot for tanking. So relying on a threshold of shield-requiring abilities might not work very well.