Your issues is in squaring the unsigned number. Once you've worked out an algorithm for that, add them up, take the average and then the root.
Personally, I'd just look for a few spikes within a given time period that were above the threshold and decide on that.