I think project honey pot is open source .. you can see if they have signature: http://www.projecthoneypot.org

You can also use chkrootkit http://www.chkrootkit.org/ to look for signature.

By the way -- Signatures is a concept. Files have a 'file signature', network traffic may have a virus signature if it is scanning for a particular part or sending fixed length data on a port.. etc. It depends what type of intrusions you want to monitor.

Thank you.I will see on resource as U said.