Multivariate Markov Transition Field (MV-MTF)

• MV-MTF is a multivariate extension of the standard Markov Transition Field, converting multivariate time series into a single image-like matrix that highlights temporal and cross-variable transitions.
• It employs per-variable discretization and pairwise transition matrices fused through both within-variable and cross-variable interactions to capture dynamic behaviors.
• The sparse formulation significantly reduces computational complexity while emphasizing one-step-lag dependencies for effective anomaly detection.

Multivariate Markov Transition Field (MV-MTF) is a multivariate extension of the Markov Transition Field representation for time series, designed to convert a multivariate time series into an image-like matrix that makes transition structure across variables and timestamps explicit. In the supplied literature, the most explicit formalization appears in Moon, where MV-MTF encodes both within-variable temporal transitions and cross-variable one-step-lag transitions, then fuses them into a single $n \times n$ image for downstream anomaly detection (Yao et al., 2 Oct 2025). A related but distinct line of work applies standard univariate MTF separately to each channel of a multivariate sequence and performs cross-feature interaction only in a later model stage; such pipelines are MV-MTF-relevant in application scope but do not constitute a strict MV-MTF in the sense of native multivariate transition-field construction (Joshi et al., 22 Aug 2025).

1. Definition and scope

Standard MTF is univariate: it discretizes one time series into states, estimates transition probabilities between those states, and expands the resulting Markov structure into an $n \times n$ field over time indices. MV-MTF generalizes this idea to multivariate time series (MTS), where each timestamp is a vector and the representation is expected to capture not only temporal evolution within each variable but also interactions across variables.

In Moon, a multivariate time series is defined as

$X = (x_1, x_2, \ldots, x_n),$

where each timestamp $x_t$ is a $c$-dimensional vector, $x_t \in \mathbb{R}^c$, so the full series has shape $n \times c$. For the $v$-th variable, $X^v$ denotes the corresponding univariate series and $x_t^v$ its value at time $n \times n$0 (Yao et al., 2 Oct 2025).

A crucial definitional boundary separates a genuine MV-MTF from a multivariate pipeline built from multiple ordinary MTFs. The distinction is methodological rather than terminological.

Work	MTF construction	Multivariate status
Moon	Pairwise variable-to-variable and time-to-time transitions, then fused into one image	Explicit MV-MTF
MTF-aided Transformer for SDN	Separate univariate MTF per feature/channel, then Transformer fusion	Multivariate application of standard MTFs

The MTF-aided Transformer paper operates on multivariate SDN traffic, with

$n \times n$1

but it explicitly states that each $n \times n$2 “corresponds to a univariate time series for feature $n \times n$3.” Its MTF stage therefore decomposes the multivariate input into $n \times n$4 separate univariate series before constructing transition fields (Joshi et al., 22 Aug 2025). This is why it is best understood as a multivariate classification architecture that uses stacked featurewise MTFs rather than a native MV-MTF.

2. Mathematical construction

Moon’s MV-MTF begins with per-variable discretization rather than a single joint discretization over $n \times n$5. For each variable $n \times n$6, the series

$n \times n$7

is mapped into $n \times n$8 discrete bins. The number of bins is chosen by searching over a candidate set $n \times n$9 and maximizing the entropy of the discretized sequence: $X = (x_1, x_2, \ldots, x_n),$0 followed by

$X = (x_1, x_2, \ldots, x_n),$1

The paper states that discretization uses quantile-based binning (Yao et al., 2 Oct 2025).

Once discretized states are assigned, MV-MTF constructs pairwise transition models between variables. For two variables $X = (x_1, x_2, \ldots, x_n),$2 and $X = (x_1, x_2, \ldots, x_n),$3, it considers transitions from $X = (x_1, x_2, \ldots, x_n),$4 to $X = (x_1, x_2, \ldots, x_n),$5. The transition matrix is presented as

$X = (x_1, x_2, \ldots, x_n),$6

while the accompanying text explains $X = (x_1, x_2, \ldots, x_n),$7 as the probability

$X = (x_1, x_2, \ldots, x_n),$8

The notation is inconsistent in the manuscript, but the intended meaning is explicit in the worked example: $X = (x_1, x_2, \ldots, x_n),$9 is a $x_t$0 matrix of empirical conditional probabilities from bins of variable $x_t$1 at time $x_t$2 to bins of variable $x_t$3 at time $x_t$4.

Field generation then lifts the pairwise transition matrix to an $x_t$5 Markov Transition Field. If $x_t$6 belongs to $x_t$7 and $x_t$8 belongs to $x_t$9, then

$c$0

Thus $c$1 is the pairwise field between source variable $c$2 and target variable $c$3. The paper’s example with

$c$4

and three bins per variable yields

$c$5

with $c$6 and

$c$7

which is then expanded into the corresponding full field $c$8 (Yao et al., 2 Oct 2025).

The multivariate aggregation stage makes the construction genuinely multivariate. For a fixed variable $c$9, the cross-variable pairwise fields are aggregated as

$x_t \in \mathbb{R}^c$0

where $x_t \in \mathbb{R}^c$1 denotes the influence degree of variable $x_t \in \mathbb{R}^c$2 on $x_t \in \mathbb{R}^c$3. The within-variable field and the aggregated cross-variable field are then fused: $x_t \in \mathbb{R}^c$4 Finally, the full MV-MTF image is obtained by summing over variables: $x_t \in \mathbb{R}^c$5 The final output is therefore one $x_t \in \mathbb{R}^c$6 matrix for the full multivariate window, not a tensor retaining separate channels for variable pairs (Yao et al., 2 Oct 2025).

A common misunderstanding is to equate MV-MTF with a joint-state Markov chain over the full $x_t \in \mathbb{R}^c$7-dimensional state space. Moon does not do that. Its states remain per-variable scalar states, and multivariate structure is introduced through pairwise cross-variable transitions and subsequent fusion.

3. Sparse formulation and computational properties

A dense multivariate extension of MTF is computationally expensive because each pairwise field $x_t \in \mathbb{R}^c$8 is, in its full form, an $x_t \in \mathbb{R}^c$9 matrix. Moon addresses this by imposing a consecutive-step-only sparsification. The paper states that “we consider only the impact of values from the previous time step on the current time,” and defines

$n \times c$0

Only the first superdiagonal is retained; all other entries are zero (Yao et al., 2 Oct 2025).

This changes the complexity of field construction from $n \times c$1 to $n \times c$2 per field. The paper presents this sparsification as a major efficiency contribution and reports conversion times for “Extended MTF” versus “MV-MTF” at data sizes 4000, 6000, 8000, and 10000. Extended MTF requires 5428.81, 12176.4, 21752.41, and 34862.44 seconds, whereas MV-MTF requires 4.44, 6.11, 7.65, and 9.25 seconds. The authors interpret the 10,000-point comparison as a 99.97% reduction (Yao et al., 2 Oct 2025).

The same paper also notes that MV-MTF execution time rises with the number of variables, with transformation taking only a few seconds for datasets with fewer than 40 variables but becoming higher for datasets with 51, 55, and 123 variables. This is consistent with the fact that pairwise cross-variable transitions are computed across ordered variable pairs. A plausible implication is that practical scaling is governed not only by window length $n \times c$3 but also by the $n \times c$4-like growth in pairwise interactions.

The sparse formulation has representational consequences. Because the field preserves only adjacent-step transitions, the representation emphasizes one-step-lag dependency patterns and does not encode long-range timestamp pairings inside the field itself. The paper makes this assumption explicitly, arguing that longer-range pairings are less meaningful for its task (Yao et al., 2 Oct 2025).

4. Relation to standard MTF and channelwise multivariate pipelines

The clearest contrast to MV-MTF is provided by the SDN intrusion-detection model that uses an “MTF-aided Transformer.” Its time-series setup is multivariate from the outset: $n \times c$5 yet the MTF preprocessing stage restates the input as

$n \times c$6

and explicitly says that each $n \times c$7 corresponds to a univariate time series for feature $n \times c$8 (Joshi et al., 22 Aug 2025).

For each feature, the paper defines a feature-specific first-order Markov transition matrix

$n \times c$9

yielding a row-normalized $v$0 matrix $v$1. It then constructs a collection of MTFs

$v$2

one per feature, rather than a single joint multivariate field. The paper’s algorithm implies the usual univariate entrywise definition

$v$3

but this exact equation is not written explicitly in the manuscript. What is explicit is that the multivariate object is a set of featurewise matrices, not a transition field over cross-variable states (Joshi et al., 22 Aug 2025).

The same work introduces a separate structural tensor

$v$4

later instantiated as $v$5 for TCP/UDP coding. This tensor captures source-destination connectivity and protocol information and is fused only in the second Transformer stage. It is not part of the MTF construction itself.

The contrast is conceptually important. In Moon, cross-variable interactions are encoded directly in the transition-field construction. In the MTF-aided Transformer, cross-feature interaction enters only later through representation concatenation and attention. Accordingly, the latter should not be described as a canonical MV-MTF formulation in the strong sense.

5. Integration in downstream models and applications

MV-MTF in Moon is not used as a standalone detector. The framework is modality-conversion-based: it first converts MTS windows into images via MV-MTF, then feeds both the original numeric series and the converted images into a Multimodal-CNN, and finally applies a SHAP-based anomaly explainer (Yao et al., 2 Oct 2025).

The motivation for this dual-branch architecture is explicit. MV-MTF is intended to make “variable-to-variable and time-to-time transitions” visible as image texture, thereby highlighting structural anomalies. At the same time, the paper notes that image conversion may lose fine-grained numerical details, so the raw numeric branch is retained to preserve patterns that are not fully captured by the image representation.

The Multimodal-CNN uses two branches with parameter sharing. One branch processes the raw numeric window; the other processes the MV-MTF image. Feature extraction employs multiple convolution kernels with varying receptive fields inspired by Omni-Scale CNN, with prime-number kernel sizes and final $v$6 and $v$7 kernels described as covering multiple scales. Cross-modal attention is then applied in both directions: numeric features attend to image features, and image features attend to numeric features. After branch-wise extraction and attention, the features are fused by concatenation and a depthwise separable convolution, followed by layer normalization, a gated feedforward network, global average pooling, and a fully connected layer for anomaly classification. Algorithm 1 confirms that MV-MTF is treated as one modality within a joint classifier trained with Adam (Yao et al., 2 Oct 2025).

The SDN intrusion-detection architecture uses a different downstream design. There, each featurewise MTF $v$8 enters a first Transformer module via linear projections

$v$9

followed by self-attention

$X^v$0

The resulting contexts are concatenated as

$X^v$1

then fused with the flattened structural tensor in a second Transformer: $X^v$2 Classification is performed via

$X^v$3

with categorical cross-entropy loss

$X^v$4

This model uses MTF-derived representations as a front end for multivariate SDN traffic analysis, but the multivariate interaction mechanism resides in the Transformer and the structural tensor rather than in the MTF stage itself (Joshi et al., 22 Aug 2025).

6. Empirical evidence, limitations, and reporting caveats

Moon reports that extensive experiments on six real-world MTS datasets show improvements of up to 93% in efficiency, 4% in accuracy, and 10.8% in interpretation performance over six state-of-the-art methods (Yao et al., 2 Oct 2025). The ablation evidence is especially relevant to MV-MTF itself. On PSM, full Moon attains F1 $X^v$5, compared with $X^v$6 for “only raw data,” $X^v$7 for “only MV-MTF data,” and $X^v$8 when replacing MV-MTF with GAF. On SMD, the corresponding F1 values are $X^v$9, $x_t^v$0, $x_t^v$1, and $x_t^v$2. The paper also presents a KL-divergence comparison in Fig. 1 as qualitative evidence that MV-MTF enlarges the distribution gap between normal and abnormal data.

The SDN intrusion-detection study provides strong evidence that MTF is useful in a multivariate application even when the construction is only channelwise. On the InSDN dataset, the proposed model reports precision/F1/recall of 99.8/99.6/99.7 at 100% data accessibility, 98.5/98.2/98.3 at 80%, and 98.3/98.0/98.1 at 60%. The reported ablation gives 99.8/99.6/99.7 for the full MTF-Transformer, 95.3/94.8/94.9 without MTF, and 93.6/92.5/93.2 without Transformer. Reported training and inference times are 1200 s and 8 ms for the proposed model, compared with 900 s and 15 ms for KNN, 1100 s and 12 ms for Random Forest, 2500 s and 20 ms for LSTM, and 2800 s and 18 ms for Donut (Joshi et al., 22 Aug 2025). These findings support the utility of MTF-based representations for multivariate time-series classification, but they do not validate a strict MV-MTF because the MTFs remain featurewise.

Several limitations and ambiguities recur across the literature. In Moon, the candidate set of bin counts $x_t^v$3, the operational choice of $x_t^v$4, any normalization before binning, and whether $x_t^v$5 is rescaled before CNN ingestion are not reported. The paper also introduces a reporting inconsistency for a parameter $x_t^v$6 used in the SHAP explainer, though this does not affect the core MV-MTF parameter $x_t^v$7 (Yao et al., 2 Oct 2025). In the SDN paper, crucial MTF-related hyperparameters are missing, including the number of quantization bins $x_t^v$8, initialization of adaptive boundaries $x_t^v$9, the Gaussian blur parameter $n \times n$00, the exact post-blur resolution, and the mapping from MTF matrices to Transformer embeddings. The manuscript also contains malformed positional encoding equations, notation inconsistencies, and an unclear embedding dimensionality statement $n \times n$01 (Joshi et al., 22 Aug 2025).

Two misconceptions are therefore best avoided. First, not every method described as “multivariate MTF-aided” is an MV-MTF in the strict mathematical sense; channelwise stacks of univariate MTFs remain standard MTFs plus downstream fusion. Second, a genuine MV-MTF need not require a single joint quantization over the full multivariate state space. Moon shows a different construction: per-variable discretization, pairwise cross-variable transition matrices, within-variable and cross-variable field fusion, and final summation into one image. Within the supplied literature, this is the clearest explicit formulation of MV-MTF proper.