  Most of today's security solutions, such as security information and event
management (SIEM) and signature based IDS, require the operator to evaluate
potential attack vectors and update detection signatures and rules in a timely
manner. However, today's sophisticated and tailored advanced persistent threats
(APT), malware, ransomware and rootkits, can be so complex and diverse, and
often use zero day exploits, that a pure signature-based blacklisting approach
would not be sufficient to detect them. Therefore, we could observe a major
paradigm shift towards anomaly-based detection mechanisms, which try to
establish a system behavior baseline -- either based on netflow data or system
logging data -- and report any deviations from this baseline. While these
approaches look promising, they usually suffer from scalability issues. As the
amount of log data generated during IT operations is exponentially growing,
high-performance analysis methods are required that can handle this huge amount
of data in real-time. In this paper, we demonstrate how high-performance
bioinformatics tools can be applied to tackle this issue. We investigate their
application to log data for outlier detection to timely reveal anomalous system
behavior that points to cyber attacks. Finally, we assess the detection
capability and run-time performance of the proposed approach.
