I am developing HMM systems that detects network anomalies, I was referring to KDD cup 99 dataset but for a particular attack, can anyone give me an example of the possible observations and the hidden states on which the observations relate to?
The KDD cup 99 dataset is biased and completely outdated. I recommend you not to use it. See http://people.scs.carleton.ca/~soma/id-2006w/readings/mchugh-darpa.pdf and http://www.icir.org/robin/papers/oakland10-ml.pdf for more information why.