The Internet of Things (IoT) is transforming almost every industry, including agriculture, food processing, health care, oil and gas, environmental protection, transportation and logistics, manufacturing, home automation, and safety. Cost-effective, small-sized batteries are often used to power IoT devices being deployed with limited energy capacity. The limited energy capacity of IoT devices makes them vulnerable to battery depletion attacks designed to exhaust the energy stored in the battery rapidly and eventually shut down the device. In designing and deploying IoT devices, the battery and device specifications should be chosen in such a way as to ensure a long lifetime of the device. This paper proposes diffusion approximation as a mathematical framework for modelling the energy depletion process in IoT batteries. We applied diffusion or Brownian motion processes to model the energy depletion of a battery of an IoT device. We used this model to obtain the probability density function, mean, variance, and probability of the lifetime of an IoT device. Furthermore, we studied the influence of active power consumption, sleep time, and battery capacity on the probability density function, mean, and probability of the lifetime of an IoT device. We modelled ghost energy depletion attacks and their impact on the lifetime of IoT devices. We used numerical examples to study the influence of battery depletion attacks on the distribution of the lifetime of an IoT device. We also introduced an energy threshold after which the device's battery should be replaced in order to ensure that the battery is not completely drained before it is replaced.