I've came through the following excellent paper written by Zenomorph

"Fingerprinting Port 80 Attacks: A look into web server, and web application attack signatures."
http://www.cgisecurity.com/papers/fi...int-port80.txt

It helps to understand IDS signatures for Web protection.