tutorial on writing attack signature based on known vulnerbility

Can someone recommend any tutoial or books on how to write IPS ruLes that detects attacks exploiting known vulnerabilities. Basically given the details of a vulnerabilty, I need some guide/examples about how to extract the signature the exploits.