I haven't looked at the code, but I have a suggestion for improving the accuracy of this detection -- Different aimbots aim at different hitboxes (usually the head), so have the module try to find a pattern in where exactly they are aiming on the target (after a snap) and record it.
So if I snap and headshot a guy 5 times, most likely I'm hacking, but if I snap and shoot him in the leg, the arm, 2 in the torso, and once in the head, it's a little less likely I'm hacking. You should take this into account along with the degree of the snap and how often it happens. Then base the confidence % on this. You would need to invent a suitable formula.