A server is provided. The server includes a communication interface configured to communicate with an electronic apparatus connected to an Internet of things (IoT) device, a storage configured to store a scenario about an attack received by the IoT device from an external apparatus by stages and information relating to a malicious code corresponding to the scenario, and a processor configured to, based on the IoT device being attacked by the external apparatus over at least one step through the electronic apparatus, receive, from the electronic apparatus, an alert for an attack received by stages, and to identify information relating to a malicious code corresponding to at least one alert received from the electronic apparatus based on the pre-stored scenario.