This will yield a lot of false positives.
I would consider doing as a correlation rule if have an ACE and use deviation factor.
As Paul_k mentions, this will raise a lot of false alarms, and you should look at correlations.
Perhaps you can define specific src and destinations, ports, or other measures.
you might be able to get help from your network team, looking at some availability stats and such