add system call learning mode