[pona-a]

But really, if HID becomes suspect too, then why do you even need kernel level anti-cheat, if all you can do is behavioral detection?

[ChocolateGod]

If you're in the kernel you at least have raw access to the USB controller and input events, thus can try pick out real mouses from fake ones.

[pona-a]

If the point of those events is to be registered by the game program, you already have all the data you need, otherwise you're building a keylogger.

The most the kernel can try to tell you is what's plugged in, but the cheater can easily make the fake HID interposed between the real keyboard and USB.