floplot has already answered this question but I figured I'd give a little more background.
IPS definitions are signatures that define network attacks. The Intrusion Prevention System uses these definitions/signatures to detect networked attacks against your computer (and sometimes from your computer as well.)
Frequently contained within these definitions are 'test' signatures. These test signatures match the detection of other signatures but are either made faster or more generic so as to catch more variants with a single signature. These sorts of changes, though, can sometimes produce false positive detections. These false positive detections, amongst other things, are sent back to Symantec (if Community Watch is enabled) in the form of IPS Detection Statistical Submissions. Using that data the test signature may be discarded altogether due to too many false positives or modified to prevent further false positive detections before replacing the already existing signatures.
Reese Anschultz
Senior Software Quality Assurance Manager, Symantec Corporation
