Posted an example starting point over on this thread
Re: Help... how can I alert on a sharp change in the WAN Utilization?
Be a good place for you to start.
Keep in mind - that it is not quite so simple as it initially seems as you will have different traffic patterns at 9 a.m. Monday morning, holidays during the week, weekends, midnight when all the backup jobs and such kick off, etc.