As we know, IoT will have various devices and can be divided into different networks. Thus, your security threat model needs to focus a certain level, but not all the levels including hardware, OS, network protocol, and application...The existing answers have clarify the good network simulators you can adopt (Cooja is a cross-level simulator but the others also can run with specific emulators like Qemu and etc).