Interesting method Frost.
When logging, how long does it take for the logged IAT to change with this method? (It may give us an idea on the iat filtering)