I have an assignment to do for school which involves attack signatures (I have to do a service-specific IDS). Basically what I have to do is to generate signatures for some attacks with Metasploit on some programs, and then I must be able to recognise these same attacks. Currently I am in the research phase, more specifically how to generate signatures of the attacks. Does anybody have any idea where I could find some good books/documents/articles for signature generation (methods, approaches....)? I've already googled and looked in the first 40-50 pages of results and didn't find a lot of great resources. Are there any books dedicated to attack signatures? Any help would be greatly appreciated! Thanks!
Edit: I will give you an example of steps. Let's say my IDS looks at the log file in generated by an application( just as example). 1) In training(learning) phase, My IDS looks in the log file to generate signatures from the attacks 2) In detection phase, my IDS will look at the log files when the application is attacked, and try to match the content from the log file with the database that holds the signatures generated in the previous step. My question is : how to generate the signatures What should I look at? For example, for the detection, I use FSA (Finite State Automaton) to express the steps of an attack (eg. ssh->open a file->read the file->upload file contents in the case of a hacker that makes a remote connection that reads a secret file and then uploads its contents)