I guess the idea is like spam filtering but for function calls. You could use a deep learning model as a classifier to detect abnormal patterns. You probably wouldn't want to use an LLM though and I'm skeptical about the accuracy and performance.