Yes you can (and should) also intercept at kernel level, but the kernel can't tell which of your app's dependencies is responsible for the call, only the application knows that.