Based on the information that Kaspersky is able to report I would have said that "internet usage time" is based on the overall duration of all the HTTP sessions for that user. This could be the time a web browser was open (1 session).
Kaspersky reports on the number and duration of each of the users sessions (browser, IM client, etc.). I imagine a session would start when any application opens that starts an active HTTP session. Idle time (once the session has started) still needs to be included in "internet usage time". The session would therefore only close when the application closes.
I would imagine that if a program on the PC starts an update then yes you could lose internet usage time, especially if this program opens an HTTP connection to download an update, which is probable. (Although it could use a different protocol, such as FTP, but I suspect that that is also monitored by Kaspersky). However, this shouldn't be too common (is it)? And shouldn't last too long (does it)?