Help... how can I alert on a sharp change in the WAN Utilization?

Help SW

I like to alert on a sharp change in my WAN Utilization.

something like

Interface Utilization is in 1 poll 30% and the next poll is 90% (+60% in 15 mim)

Or from 3% to 60% (+57% change in 15 min)

Why ?

1.DDOS

2.DDOS

3.more DDOS