The sudden increases *should* be covered by using the baselines and dynamic thresholds feature of NPM. Simply edit the interface(s), and if you scroll down all the way to the bottom you will see options to set warning and critical thresholds based on baseline data. It uses 2x standard deviation for warning, and 3x standard deviation for critical threshold. The trigger condition in your Alert is going to be something like 'Transmit % utilisation has exceeded critical threshold'
If dynamic thresholds are enabled, the thresholds should get updated in the InterfacesThresholds table. There *may* be a way to extract the average and the standard deviation (standard deviation should be the difference between critical and warning thresholds) from this table to determine the low bars to determine traffic drops. I haven't had a chance to dig into the required SQL to see if it's possible