What Does Normal Even Mean? Evaluating Benign Traffic in Intrusion Detection Datasets