I imagine you can do that with one analytic view summing received bytes and another analytic view averaging received bytes (using a count as your divider).
Pull both analytic views into a calculation view to determine fraud, using projections to grab the columns you want from each analytic view (most of the fields like user and sum from analytic view 1, and the average from view 2) and finally union them together.