Abstract: With the adoption of the general standard of communication protocol, wireless service system (WSS) in IoT is proposed to achieve the real-time connection between person and things or things and things. According to the characteristics of IEEE 802.15.4, wireless sensor nodes are embedded in the devices for data collection and command broadcasting. However, the isomorphism of the sensor nodes makes the worm propagation an increasingly serious problem. Firstly, based on the classification of epidemiological models related to worm propagation and the analysis of the characteristics of various models, an epidemiological model is constructed, which specially introduces sleep state and quarantine state into state transition. The transition relationship of nodes is defined simultaneously. Secondly, according to the radio frequency, the number and range of infected nodes with actual transmission ability are determined. Thirdly, we introduce the target cost function between worm and wireless service system, and put forward a dynamic differential game with complete information based on the overall damage. Then, the existence of saddle-point solution is proved, which is solved by combining state parameters, cooperative state variables and Hamiltonian functions. The optimal defense algorithm is proposed to minimize target cost function. Finally, different algorithms are implemented and the performance evaluation is carried out by comparing the characteristics of nodes in each state and the corresponding overall damage. The experimental results show that the optimal defense algorithm based on improved epidemic model can suppress worm propagation in wireless service system effectively and efficiently.