The use of alert thresholding in an IDS can reduce the volume of repeated alerts, but introduces which of the following vulnerabilities?

Thresholding triggers alerts only when event counts or rates exceed a configured limit within a time window. An attacker who deliberately paces their activity - such as port scanning one port per minute instead of thousands per second - stays below the threshold and generates no alerts. This slow-and-low technique is a well-known IDS evasion method that thresholding directly enables.

Alert thresholding controls when alerts are generated, not whether packets are forwarded; an IDS does not drop network traffic based on alert volume thresholds.

Packet reassembly is handled by the IDS detection engine independently of the alerting subsystem, and threshold configuration does not interfere with fragmented packet handling.

Thresholding limits how often alerts fire for repeated events but does not merge traffic from different sources or prevent the IDS from tracking source addresses individually.