As a user, I want the system to trigger an alert only when a threshold of Deauth packets is exceeded, So that I avoid false positives from normal network disconnections.
Definition of Done:
Time-window counter implemented (e.g., packets per second).
Threshold logic (if count > N then ALERT).
State machine (Safe -> Warning -> Attack).
Size: 2 MD
As a user, I want the system to trigger an alert only when a threshold of Deauth packets is exceeded, So that I avoid false positives from normal network disconnections.
Definition of Done:
Time-window counter implemented (e.g., packets per second).
Threshold logic (if count > N then ALERT).
State machine (Safe -> Warning -> Attack).
Size: 2 MD