It's difficult to think of things you could watch that would only occur during a raid. The examples given: ethernet and wi-fi, both go down much more often than you would like to think. Usually it's only for microseconds, but if you have a program that happens to check right then, there goes your encryption keys.

A tweak to the code would be to make sure that the sensor stays in the fail state for a particular duration. Even a few seconds would get rid of a lot of the false positives.