Methods and systems for restoring networks to normal behavior are disclosed. For example, in various embodiments an apparatus for addressing device abnormalities in a network may include node monitoring circuitry configured to monitor device abnormalities in the network, and ranking circuitry that may receive information from the node monitoring device and, upon receiving information from the monitoring circuitry that multiple devices in the network are compromised, may provide ranking information as to which of the multiple compromised devices in the network is to be attended to first.