IoT OTA simulation with integrated attack injection and ML-based threat detection across four operational tiers. The architecture chains a Python IoT client and Flask OTA server through multiple attack vectors—DDoS via Scapy, reconnaissance via nmap, MITM via mitmproxy, and Python-based intrusion and backdoor payloads—while background traffic layers (ARP, ICMP, DNS, MQTT) provide realistic network noise. tshark captures loopback traffic, segments 120 sessions, extracts 38 features, and feeds a pre-trained XGBoost model to evaluate detection accuracy. This end-to-end pipeline demonstrates how to generate labeled security datasets and validate anomaly detection in IoT environments without risking production systems.