Possibly,
The field the packet size is parsed to needs to be an integer, and likely assigned to an index (possible custom field required and index assigned)
I want to say that you can use % over baseline on averages with an accumulator index, and it works as you are envisioning, but please take this with a grain of salt as I have not built this specific use case concept myself.
::EDIT::
It appears that distinct value is the only option available, which will look at the changes in distinct values given in the field, and then give a baseline difference between typical values, and how many new values were seen.
It appears this cannot be done off of event data unfortunately. NetFlow data however you can.