Abstract: Internet of things (IoT) system is a complex system, which faced with serious security challenges. Current risk evaluation method of IoT is qualitative but lack of quantitative assessment methods. Malicious attacks of IoT system are classified according to attack surface and attack point. Then a security analysis model using fuzzy comprehensive evaluation method is proposed bases on three elements of each attack, there are damage degree, occurrence probability and the complexity of reinforcement, which can be used as quantitative assessment methods of IoT system.

Key words: IoT security, security threat, risk assessment, fuzzy comprehensive evaluation