Abstract: A method and system for detecting ruleset misconfiguration in a computer network. The method including: generating a set of sample data flows; evaluating each of the set of sample data flows against a predetermined definition to generate a flow descriptor for each of the set of sample data flows; evaluating each of the flow descriptors against a ruleset; and generating a summary of how each of the flow descriptors perform with respect to the ruleset. The system including: a data flow sample retrieval module configured to generate flows; a policy engine configured to store and retrieve a ruleset; a packet processing engine configured to evaluate each of the data flows against a predetermined definition to generate a flow descriptor for each flows, evaluate each of the flow descriptors against a ruleset; and generate a summary of how each of the flow descriptors perform with respect to the ruleset.