A method for dealing with attacks of malicious BOTs in a network security system includes detecting and analyzing a domain name receiving excessive DNS queries to judge the infection of a malicious BOT, registering the corresponding domain name as normal or abnormal management target, and redirecting an abnormal DNS query for the abnormal management target to a redirection processing & response system. Thereby, the automatic detection of malicious BOT attacks and the mechanism which performs the measures and the analysis simultaneously can protect the DNS servers and prevent the security accidents by malicious BOT attacks previously.