Suppose Alice has $x$ and Bob has $y$ in your scenario, and let $\pi =(\pi_A, \pi_B)$ be the protocol machines for Alice & Bob respectively. Here is how you would formally define security of the protocol against a corrupt Alice.
Define the following algorithms / random variables:
${\sf Real}(\pi, y,\mathcal{A},1^k)$:
Internally simulate an instance of $\pi_B$ on inputs $(1^k,y)$, interacting with an instance of $\mathcal{A}$ on input $1^k$.
$\pi_B$ will eventually terminate; call its output $q$ (note, this is supposed to be the output of $f$, or it can be an error indicator). Likewise $\mathcal{A}$ will eventually terminate; call its output $t$.
Output $(q,t)$.
${\sf Ideal}(f, y,\mathcal{S},1^k)$:
Internally simulate an instance of $\mathcal{S}$ on input $1^k$ until it generates an output $\tilde x$.
Calculate $p = f_A(\tilde x, y)$ and $q = f_B(\tilde x, y)$.
Give $p$ to $\mathcal{S}$ and keep running it until it finally terminates; call its output $t$.
Output $(q,t)$.
Then we say that the protocol is secure if:
For all PPT machines $\mathcal{A}$ there exists a PPT machine $\mathcal{S}$ such that for all $x,y$, the ensembles $\{ {\sf Real}(\pi, y,\mathcal{A},1^k) \}_k$ and $\{ {\sf Ideal}(f, y,\mathcal{S},1^k) \}_k$ are computationally indistinguishable.
I'll assume you're comfortable with the notion of computational indistinguishability.
Some general observations:
The value $t$ is whatever $\mathcal{A}$ decides to output. One reason why it's difficult to understand at first is that we are not specifying a "goal" that $\mathcal{A}$ wants to achieve. It's more general than that. Instead, we're saying that: Any value $t$ that $\mathcal{A}$ can generate by participating in the real interaction, is possible to generate when the only thing you are allowed to do is choose an input $\tilde x$ (once) and get back $f_A(\tilde x, y)$.
Without loss of generality, $t$ can be the entire view (private randomness along with all of the messages received in the protocol) of $\mathcal{A}$, since $t$ would have been efficiently computed from the view. Sometimes the terms view and transcript are used synonymously, though the term view better entails that private randomness is included as well. Also, this is why $\mathcal{S}$ is referred to as a simulator, since it must be able to simulate everything that $\mathcal{A}$ would have seen.
We also include the output $q$ of the honest party Bob in these distribution ensembles. This models the fact that $\mathcal{A}$, in addition to learning no more than is possible in the ideal world, has an effect on Bob that is possible in the ideal world. In particular, $\mathcal{A}$ can't force Bob to output a value that is inconsistent with $f$ (other more subtle attacks are also ruled out in this way).
Of course, even this fairly detailed definition does not include everything tha there is to say. To be absolutely precise you have to specify how the protocol interaction works, whether the adversary has control over delivery of messages, whether the multiple components (adversary, protocol) should be executed in series or parallel, etc.. But once you have conventions for these things, the $\sf Real$ and $\sf Ideal$ processes are well-defined, and everything else written here is pretty sound.
More sophisticated definitions allow $\mathcal{A}$ (and hence $\mathcal{S}$) to communicate online (i.e., during the protocol execution) with an external "environment" ... that introduces a whole lot of other complications. So for the purposes of this response, we'll leave it as a static interaction.
