 One heuristic method, known as static heuristic analysis, involves de-compiling a suspect program and examining its source code.This code is then compared to viruses that are already known and are in the heuristic database.If a particular percentage of the source code matches anything in the heuristic database, the code is flagged as a possible threat.