1. A method comprising: obtaining access to a plurality of information flow theories for a plurality of malicious programs, said information flow theories comprising differences in information flows between said malicious programs, executing in a controlled environment, and information flows of known benign programs; monitoring execution of a suspicious program by comparing runtime behavior of said suspicious program to said plurality of information flow theories; and outputting an alarm if said runtime behavior of said suspicious program matches at least one of said plurality of information flow theories, wherein said monitoring comprises comparing information flow facts about said runtime behavior of said suspicious program generated by a plurality of heuristics to said plurality of information flow theories, said method further comprising: initially using all of said plurality of heuristics; monitoring performance overhead of each of said plurality of heuristics; and subsequently using a subset of said plurality of heuristics, based on said monitoring of said overhead, and at least one strategy.