IPS signatures describe the characteristics of attack behaviors on the network.

Explanation From HCIA-Security documents:

IPS works by identifying malicious traffic patterns and behaviors in network data. An IPS signature is a set of detection rules that describe known attack characteristics, such as specific byte sequences in payloads, abnormal protocol fields, exploit patterns, or behavior indicators that match a recognized threat. When traffic passes through the firewall with IPS enabled, the device performs protocol decoding and (when needed) stream or application data reassembly so it can inspect complete content instead of isolated packets. After that, it compares the reconstructed traffic against the IPS signature database. If a match is found, the firewall determines the traffic is malicious and then takes the configured action, such as blocking packets, resetting the connection, discarding the session, and generating logs/alarms for visibility and auditing. This signature-based comparison is a core detection method of IPS and is why keeping the signature library updated is important: new attack techniques require new or improved signatures. Therefore, the statement is correct: the firewall detects and defends by comparing data flows with IPS signatures.