Hi!
You can use actions with timers. For example, execute action on node down event with timer set to 5 minutes, and cancel this timer on "node up" event. If node will recover within 5 minute interval, timer will be cancelled and action never executed.
Yes, diff will be correct method in this case.
Best regards,
Victor