How about we start with what you have already tried to see if it can be improved?
Maybe give example of keylogger code and tell us more about what "doesn't work very well"?
As for User and Kernel Space - generally something done in User Space will require lest changes to your overall system
and potentially have less side effects that you have to later work out. So I would place this in perhaps the easier pile
although have had experience that this is not always the case
As far as options for doing either, google is your friend.