Is it possible to generate a alarm based on threshold value.

Example average number of connection per second for port 21 Falls between one to three connections per second. If Port 21 Falls above the average of 3 connections. Then there is abnormal behavior.
Above scenario is possible ? If it is then how?