I've came through the following excellent paper written by Zenomorph
"Fingerprinting Port 80 Attacks: A look into web server, and web application attack signatures."
http://www.cgisecurity.com/papers/fi...int-port80.txt
It helps to understand IDS signatures for Web protection.
