A method for preventing security accidents caused by malicious BOTs, comprising the steps of: detecting the amount of DNS queries for a specific domain name received from a compromised computer which exceeds a preset threshold value; identifying the domain names of these queries and classifying the domain name as normal or abnormal; and in the case of a domain name classified as normal, registering the domain name in a normal management target list of a redirection processing system; in the case of a domain name classified as abnormal, registering the domain name in an abnormal management target list of a redirection processing system; redirecting DNS queries for a domain name registered in the abnormal management target list to a redirection processing and response system including a firewall, a sinkhole L4 switch and a sinkhole DNS server; wherein the redirecting step further comprises: changing, by the redirection processing system, a destination address of the abnormal DNS query into an address of the firewall of the redirection processing and response system; transmitting, by the redirection processing system, the abnormal DNS query having a destination address of the firewall to the firewall; changing, by the firewall, using Network Address Translation, the address of the redirected abnormal DNS query to an address of the sinkhole DNS server; forwarding, by the firewall, the redirected abnormal DNS query having an address of sinkhole DNS server to the sinkhole DNS server; generating, by the sinkhole DNS server, a response to the abnormal DNS query in the redirection processing and response system; and transmitting by the sinkhole DNS server through the sinkhole L4 switch, the response to the compromised computer, wherein the response generated from the generating step has the same source IP address as that of a response to a DNS query where the domain name of the DNS query has been registered in a normal management target list; characterised in that the response generated from the generating step has a loop-back address preset by a network administrator to contain network traffic generated by the compromised computer. detecting the amount of DNS queries for a specific domain name received from a compromised computer which exceeds a preset threshold value; identifying the domain names of these queries and classifying the domain name as normal or abnormal; and in the case of a domain name classified as normal, registering the domain name in a normal management target list of a redirection processing system; in the case of a domain name classified as abnormal, registering the domain name in an abnormal management target list of a redirection processing system; redirecting DNS queries for a domain name registered in the abnormal management target list to a redirection processing and response system including a firewall, a sinkhole L4 switch and a sinkhole DNS server; wherein the redirecting step further comprises: changing, by the redirection processing system, a destination address of the abnormal DNS query into an address of the firewall of the redirection processing and response system; transmitting, by the redirection processing system, the abnormal DNS query having a destination address of the firewall to the firewall; changing, by the firewall, using Network Address Translation, the address of the redirected abnormal DNS query to an address of the sinkhole DNS server; forwarding, by the firewall, the redirected abnormal DNS query having an address of sinkhole DNS server to the sinkhole DNS server; generating, by the sinkhole DNS server, a response to the abnormal DNS query in the redirection processing and response system; and transmitting by the sinkhole DNS server through the sinkhole L4 switch, the response to the compromised computer, wherein the response generated from the generating step has the same source IP address as that of a response to a DNS query where the domain name of the DNS query has been registered in a normal management target list; characterised in that the response generated from the generating step has a loop-back address preset by a network administrator to contain network traffic generated by the compromised computer. changing, by the redirection processing system, a destination address of the abnormal DNS query into an address of the firewall of the redirection processing and response system; transmitting, by the redirection processing system, the abnormal DNS query having a destination address of the firewall to the firewall; changing, by the firewall, using Network Address Translation, the address of the redirected abnormal DNS query to an address of the sinkhole DNS server; forwarding, by the firewall, the redirected abnormal DNS query having an address of sinkhole DNS server to the sinkhole DNS server; generating, by the sinkhole DNS server, a response to the abnormal DNS query in the redirection processing and response system; and transmitting by the sinkhole DNS server through the sinkhole L4 switch, the response to the compromised computer, wherein the response generated from the generating step has the same source IP address as that of a response to a DNS query where the domain name of the DNS query has been registered in a normal management target list; characterised in that the response generated from the generating step has a loop-back address preset by a network administrator to contain network traffic generated by the compromised computer.