[Question] Monitoring system calls and hooks for dynamic rule execution

Today on the monthly call I asked a question on how to **monitor system calls (in the context of anomaly detection for intrusion detection systems)** in the gVisor sentry, since that is where all system calls are intercepted. I was asked to open an issue here for further discussion on the subject.

There are really two parts to this issue/discussion:
1. I want to be able to monitor system calls in real-time to check for "intrusion detection" patterns that deviate from the norm.
2. I want to be able to block system calls in "real-time" based on the result of a dynamic policy (perhaps leveraging anomaly detection as an example).

The **eventual goal** would be to enable hooks be able to act on the system call data in real time. As I learned today on the call, there seem to be use cases for asynchronous _and_ synchronous blocking of system calls.

A few options were floated:
* Fork and run gVisor with the tweaks coded in (not a very good option)
* Leverage the event system in gVisor (I did not understand what exactly this was referring to, and a few grep's did not yield anything meaningful).
* For simple monitoring, the given `strace` _may_ suffice.
* There were some specific parts of the codebase that were mentioned by @amscanne which could be modified to have a better interface for external operations.

What I am looking for:
For now, pointing me in the direction of the right places in the codebase to look at from the above mentioned options would be great. Once I am able to look at this, I will be able to figure out what the current capabilities of the system are and where to take it.

Further notes:
I currently do not have specific existing tools for this monitoring in mind, I am more interested understanding what is here and leveraging that for some tooling I plan to roll on my own, but I am open to suggestions on tools that can integrate with gVisor already (or with a few tweaks).
I am happy to make changes to the codebase as needed with the right guidance.