A server comprising: a communication interface configured to communicate with an electronic apparatus connected to an Internet of things, loT, device; a storage; and a processor, wherein the storage is configured to store a scenario about a plurality of attacks sequentially executed by an external apparatus and information relating to a malicious code corresponding to the scenario; and the processor is configured to: in response to the loT device being attacked sequentially by the external apparatus over a plurality of attacks through the electronic apparatus, receive sequentially, from the electronic apparatus, a plurality of alerts corresponding to the plurality of attacks, identify a chronological order of the plurality of attacks based on time information of the plurality of attacks included in the plurality of alerts, identify a scenario having a same chronological order of the plurality of attacks received by the loT device from among a plurality of pre-stored scenarios, identify information relating to a malicious code corresponding to the identified scenario, and transmit the identified information relating to the malicious code to at least one of a user terminal or the loT device, wherein the information relating to the malicious code includes a name of the malicious code to be executed in the loT device by the external apparatus or injected into the loT device, and guide information for defending the malicious code, wherein the processor is further configured to, based on the scenario having the same chronological order of the plurality of attacks received by the loT device not being present from among the plurality of pre-stored scenarios, transmit guide information requesting to block a network connection with the external apparatus to at least one of the user terminal or the loT device. a communication interface configured to communicate with an electronic apparatus connected to an Internet of things, loT, device; a storage; and a processor, wherein the storage is configured to store a scenario about a plurality of attacks sequentially executed by an external apparatus and information relating to a malicious code corresponding to the scenario; and the processor is configured to: in response to the loT device being attacked sequentially by the external apparatus over a plurality of attacks through the electronic apparatus, receive sequentially, from the electronic apparatus, a plurality of alerts corresponding to the plurality of attacks, identify a chronological order of the plurality of attacks based on time information of the plurality of attacks included in the plurality of alerts, identify a scenario having a same chronological order of the plurality of attacks received by the loT device from among a plurality of pre-stored scenarios, identify information relating to a malicious code corresponding to the identified scenario, and transmit the identified information relating to the malicious code to at least one of a user terminal or the loT device, wherein the information relating to the malicious code includes a name of the malicious code to be executed in the loT device by the external apparatus or injected into the loT device, and guide information for defending the malicious code, wherein the processor is further configured to, based on the scenario having the same chronological order of the plurality of attacks received by the loT device not being present from among the plurality of pre-stored scenarios, transmit guide information requesting to block a network connection with the external apparatus to at least one of the user terminal or the loT device. in response to the loT device being attacked sequentially by the external apparatus over a plurality of attacks through the electronic apparatus, receive sequentially, from the electronic apparatus, a plurality of alerts corresponding to the plurality of attacks, identify a chronological order of the plurality of attacks based on time information of the plurality of attacks included in the plurality of alerts, identify a scenario having a same chronological order of the plurality of attacks received by the loT device from among a plurality of pre-stored scenarios, identify information relating to a malicious code corresponding to the identified scenario, and transmit the identified information relating to the malicious code to at least one of a user terminal or the loT device, wherein the information relating to the malicious code includes a name of the malicious code to be executed in the loT device by the external apparatus or injected into the loT device, and guide information for defending the malicious code, wherein the processor is further configured to, based on the scenario having the same chronological order of the plurality of attacks received by the loT device not being present from among the plurality of pre-stored scenarios, transmit guide information requesting to block a network connection with the external apparatus to at least one of the user terminal or the loT device.