I've thought about somehow creating a raspberry pi that sits between usb devices and snitches on data transfer that is not expected? It could be really hard to

I've thought about somehow creating a raspberry pi that sits between usb devices and snitches on data transfer that is not expected? It could be really hard to do, and probably easy for a device to mask (only attempt attacks when other file operations are happening)