- learning techniques
- common sense
Their objective is to recognise a virus by analysing its code (not limited to). If a program is programmed to open a certain file, or to load/read certain memory address.
These methods are based on multiple criteria. They eventually can run program in virtual environment to monitor for known virus schemes : replication, stealth etc.
Behaviourism is analysis in real time. By analysing what a program is doing (file I/O, memory I/O, network I/O, use of the PC during idle time, ...) you can assess whether it is legitimate or not. If one program begins firing packet on 100 IP addresses on each port, you can be sure it's a virus, because it is not a normal behaviour for a program.
I would conclude saying this: behaviourism deals with unknown behaviour (certainly try to profile the user behaviour to detect changes in normal activity) and it certainly uses heuristic. Heuristics objective is to detect an unknown virus, or variant, but the scheme they are looking for are well known.