[TRACKING] New anomalydetection Plugin - Targeting First Release for Falco 0.39.0

[incertum]

Motivation

This issue is to track the development progress for a new anomalydetection plugin, as outlined in the Proposal.

The objective is to provide updates on the progress of the development, ensuring alignment with the proposed framework. Additionally, it aims to identify any potential blockers that may hinder progress.

The initial scope will focus exclusively on "CountMinSketch Powered Probabilistic Counting and Filtering" for a subset of syscalls and a selection of options to define behavior profiles. The primary objective of this new framework is to offer tangible advantages in real-world production environments and substantially improve the usability of standard Falco rules. Essentially, this framework eliminates the requirement for meticulous tuning of individual rules and facilitates the utilization of probabilistic count estimates to alleviate the impact of noisy rules. Additionally, it enables the creation of broader Falco rules.