In KDD CUP'99 there are time-based features calculated in last 2 seconds. But in the dataset there is only on record for a 8000 seconds long telnet connection. Shouldn't there exists a record for each packet received during that telnet connection?
Why time-based features are defined if there are not in use? The same is true for connection-based features which are calculated for last 100 connections.
In other words, KDD CUP'99 is offline. Each record represents a closed connection. If one trys to calculated the same features, but online, on DARPA 1998 dataset, will he get better results? for example, could he flag a telnet connection as attack at second 2312, that otherwise couldn't be detected at end of connection as it is the case in KDD CUP dataset.
I am aware that using KDD CUP'99 dataset is not recommended. But my question is about the features not the dataset. Also, I asked the same question here in different form, but it got closed.