I'll try to keep this simple, so the details may not be accurate. See this answer as a primer.
By singing a transaction, you provide proof that you and only you could have created it. Transaction signing is possible, because there exists a relationship between your private key (which you keep secret) and your public key (which can be displayed. Your ethereu address is derived off your public key)
To sign a transaction, the transaction is put into a function which we shall call
Sign, along with your private key. The output of
Sign is the signature, which is appended to the transaction message and sent into the network for mining.
To proof that a transaction was signed by the owner of the private key of an address, another function is used, which we'll call
Verify takes two inputs: your transaction,and the signature. The output of this function is your public key, which can translated to your address. A transaction is valid, if, and only if, the address that can be derived from the output of
Verify, is the same as the address of the sender of the message.
This way, transacations can only be done by the person that has access to the private key.