A method for protecting against mass NF deregistration attacks can be performed at an NRF or SCP. The method includes receiving an NFDeregister request for deregistering an NF. The method further includes classifying the NFDeregister request as suspect based on application of suspect NFDeregister request classification rules. The method further includes in response to classifying the NFDeregister request as suspect, queueing the NFDeregister request. The method further includes receiving an NF heart-beat message concerning the NF. The method further includes determining that the NF heart-beat message is received within an NF heart-beat time interval for the NF. The method further includes in response to determining that the NF heart-beat message is received within the NF heart-beat time interval for the NF, preventing processing of the NF Deregister request and blacklisting a sender of the NFDeregister request.