For example host 1.2.3.4 has reached threshold for blackhole and stays above for 5 minutes and only after that period of time / duration FastNetMon will declare it as an attack.

It will help to reduce number of false positives caused by legitimate traffic.