---
title: Multivariate Markov Transition Field (MV-MTF)
url: https://www.emergentmind.com/topics/multivariate-markov-transition-field-mv-mtf
type: topic
---

# Multivariate Markov Transition Field (MV-MTF)

Multivariate Markov Transition Field (MV-MTF) is a multivariate extension of the Markov Transition Field representation for time series, designed to convert a multivariate time series into an image-like matrix that makes transition structure across variables and timestamps explicit. In the supplied literature, the most explicit formalization appears in Moon, where MV-MTF encodes both within-variable temporal transitions and cross-variable one-step-lag transitions, then fuses them into a single \(n \times n\) image for downstream anomaly detection [2510.01970]. A related but distinct line of work applies standard univariate MTF separately to each channel of a multivariate sequence and performs cross-feature interaction only in a later model stage; such pipelines are MV-MTF-relevant in application scope but do not constitute a strict MV-MTF in the sense of native multivariate transition-field construction [2508.16035].

## 1. Definition and scope

Standard MTF is univariate: it discretizes one time series into states, estimates transition probabilities between those states, and expands the resulting Markov structure into an \(n \times n\) field over time indices. MV-MTF generalizes this idea to multivariate time series (MTS), where each timestamp is a vector and the representation is expected to capture not only temporal evolution within each variable but also interactions across variables.

In Moon, a multivariate time series is defined as
\[
X = (x_1, x_2, \ldots, x_n),
\]
where each timestamp \(x_t\) is a \(c\)-dimensional vector, \(x_t \in \mathbb{R}^c\), so the full series has shape \(n \times c\). For the \(v\)-th variable, \(X^v\) denotes the corresponding univariate series and \(x_t^v\) its value at time \(t\) [2510.01970].

A crucial definitional boundary separates a genuine MV-MTF from a multivariate pipeline built from multiple ordinary MTFs. The distinction is methodological rather than terminological.

| Work | MTF construction | Multivariate status |
|---|---|---|
| Moon | Pairwise variable-to-variable and time-to-time transitions, then fused into one image | Explicit MV-MTF |
| MTF-aided Transformer for SDN | Separate univariate MTF per feature/channel, then Transformer fusion | Multivariate application of standard MTFs |

The MTF-aided Transformer paper operates on multivariate SDN traffic, with
\[
X = \{X_1, X_2, ..., X_t, ..., X_T\}, \qquad
X_t = \{x_{t,1}, x_{t,2}, \dots, x_{t,L}\},
\]
but it explicitly states that each \(x_{t,l}\) “corresponds to a univariate time series for feature \(l\).” Its MTF stage therefore decomposes the multivariate input into \(L\) separate univariate series before constructing transition fields [2508.16035]. This is why it is best understood as a multivariate classification architecture that uses stacked featurewise MTFs rather than a native MV-MTF.

## 2. Mathematical construction

Moon’s MV-MTF begins with per-variable discretization rather than a single joint discretization over \(\mathbb{R}^c\). For each variable \(u\), the series
\[
X^u = \{x_1^u, x_2^u, \ldots, x_n^u\}
\]
is mapped into \(Q_u\) discrete bins. The number of bins is chosen by searching over a candidate set \(Q\) and maximizing the entropy of the discretized sequence:
\[
H(Q^u) = -\sum_{i=0}^{|Q_u|-1} p_i \log p_i,\quad
p_i = \frac{1}{n} \sum_{t=1}^{n} I(Q_t^u = i),
\]
followed by
\[
Q_u^* = \arg\max_{Q_u \in Q} H(Q^u).
\]
The paper states that discretization uses quantile-based binning [2510.01970].

Once discretized states are assigned, MV-MTF constructs pairwise transition models between variables. For two variables \(u\) and \(u'\), it considers transitions from \(x_{t-1}^u\) to \(x_t^{u'}\). The transition matrix is presented as
\[
W = \left[ w_{ij} \mid P\left(x_t^{u'} \in q_i^{u'} \mid x_{t-1}^{u} \in q_j^{u}\right) \right],
\]
while the accompanying text explains \(w_{i,j}\) as the probability
\[
P( x_t^{u'} \in q^{u'}_{j}\mid x_{t-1}^u \in q^{u}_{i}).
\]
The notation is inconsistent in the manuscript, but the intended meaning is explicit in the worked example: \(W\) is a \(Q_u \times Q_{u'}\) matrix of empirical conditional probabilities from bins of variable \(u\) at time \(t-1\) to bins of variable \(u'\) at time \(t\).

Field generation then lifts the pairwise transition matrix to an \(n \times n\) Markov Transition Field. If \(x_i^u\) belongs to \(q_a^u\) and \(x_j^{u'}\) belongs to \(q_b^{u'}\), then
\[
m_{ij} = w_{ab}.
\]
Thus \(M_{u,u'}\) is the pairwise field between source variable \(u\) and target variable \(u'\). The paper’s example with
\[
X^u = (0.1, 0.3, 0.05, 0.4, 0.15, 0.2), \qquad
X^{u'} = (0.2, 0.3, 0.45, 0.3, 0.35, 0.4)
\]
and three bins per variable yields
\[
X_q^u = (1, 3, 1, 3, 1, 2), \qquad
X_q^{u'} = (1, 2, 3, 2, 2, 3),
\]
with \(w_{12} = \frac{2}{3}\) and
\[
W = \begin{bmatrix}
0 & 2/3 & 1/3 \\
0 & 0   & 0   \\
0 & 1/2 & 1/2
\end{bmatrix},
\]
which is then expanded into the corresponding full field \(M\) [2510.01970].

The multivariate aggregation stage makes the construction genuinely multivariate. For a fixed variable \(u\), the cross-variable pairwise fields are aggregated as
\[
M_{u,\cdot}=\sum_{k=1, k\ne u}^{c} \omega_{u,k} \times M_{u,k},
\]
where \(\omega_{u,k}\) denotes the influence degree of variable \(k\) on \(u\). The within-variable field and the aggregated cross-variable field are then fused:
\[
M_{u}=\alpha \times M_{u, u} + (1- \alpha)\times M_{u,\cdot}.
\]
Finally, the full MV-MTF image is obtained by summing over variables:
\[
M_{X} =\sum_{u=1}^{c} M_{u}.
\]
The final output is therefore one \(n \times n\) matrix for the full multivariate window, not a tensor retaining separate channels for variable pairs [2510.01970].

A common misunderstanding is to equate MV-MTF with a joint-state Markov chain over the full \(c\)-dimensional state space. Moon does not do that. Its states remain per-variable scalar states, and multivariate structure is introduced through pairwise cross-variable transitions and subsequent fusion.

## 3. Sparse formulation and computational properties

A dense multivariate extension of MTF is computationally expensive because each pairwise field \(M_{u,u'}\) is, in its full form, an \(n \times n\) matrix. Moon addresses this by imposing a consecutive-step-only sparsification. The paper states that “we consider only the impact of values from the previous time step on the current time,” and defines
\[
M_{ij}=
\left\{
\begin{array}{ll}
m_{i,j}, & \text{if } j=i+1 \\
0, & \text{otherwise.}
\end{array}
\right.
\]
Only the first superdiagonal is retained; all other entries are zero [2510.01970].

This changes the complexity of field construction from \(O(n^2)\) to \(O(n)\) per field. The paper presents this sparsification as a major efficiency contribution and reports conversion times for “Extended MTF” versus “MV-MTF” at data sizes 4000, 6000, 8000, and 10000. Extended MTF requires 5428.81, 12176.4, 21752.41, and 34862.44 seconds, whereas MV-MTF requires 4.44, 6.11, 7.65, and 9.25 seconds. The authors interpret the 10,000-point comparison as a 99.97% reduction [2510.01970].

The same paper also notes that MV-MTF execution time rises with the number of variables, with transformation taking only a few seconds for datasets with fewer than 40 variables but becoming higher for datasets with 51, 55, and 123 variables. This is consistent with the fact that pairwise cross-variable transitions are computed across ordered variable pairs. A plausible implication is that practical scaling is governed not only by window length \(n\) but also by the \(c^2\)-like growth in pairwise interactions.

The sparse formulation has representational consequences. Because the field preserves only adjacent-step transitions, the representation emphasizes one-step-lag dependency patterns and does not encode long-range timestamp pairings inside the field itself. The paper makes this assumption explicitly, arguing that longer-range pairings are less meaningful for its task [2510.01970].

## 4. Relation to standard MTF and channelwise multivariate pipelines

The clearest contrast to MV-MTF is provided by the SDN intrusion-detection model that uses an “MTF-aided Transformer.” Its time-series setup is multivariate from the outset:
\[
X = \{X_1, X_2, ..., X_t, ..., X_T\}, \qquad
X_t = \{x_{t1}, x_{t2}, ..., x_{tl}, ..., x_{tL}\},
\]
yet the MTF preprocessing stage restates the input as
\[
X_t = \{x_{t,1}, x_{t,2}, \dots, x_{t,L}\},
\]
and explicitly says that each \(x_{t,l}\) corresponds to a univariate time series for feature \(l\) [2508.16035].

For each feature, the paper defines a feature-specific first-order Markov transition matrix
\[
P(q_i \mid q_j) =
\frac{\text{count}(x_k \in q_j, x_{k+1} \in q_i)}
{\sum_{j=1}^Q \text{count}(x_k \in q_j)},
\]
yielding a row-normalized \(Q \times Q\) matrix \(W_l\). It then constructs a collection of MTFs
\[
MTF(X_t) = \{M_{t,1}, M_{t,2}, \dots, M_{t,L}\},
\]
one per feature, rather than a single joint multivariate field. The paper’s algorithm implies the usual univariate entrywise definition
\[
[M_{t,l}]_{i,j} = P(q_{t_i} \mid q_{t_j}),
\]
but this exact equation is not written explicitly in the manuscript. What is explicit is that the multivariate object is a set of featurewise matrices, not a transition field over cross-variable states [2508.16035].

The same work introduces a separate structural tensor
\[
S = \{S_1, S_2, ..., S_t, ..., S_T\}, \qquad
S_t \in \mathbb{R}^{N \times N \times P},
\]
later instantiated as \(N \times N \times 2\) for TCP/UDP coding. This tensor captures source-destination connectivity and protocol information and is fused only in the second Transformer stage. It is not part of the MTF construction itself.

The contrast is conceptually important. In Moon, cross-variable interactions are encoded directly in the transition-field construction. In the MTF-aided Transformer, cross-feature interaction enters only later through representation concatenation and attention. Accordingly, the latter should not be described as a canonical MV-MTF formulation in the strong sense.

## 5. Integration in downstream models and applications

MV-MTF in Moon is not used as a standalone detector. The framework is modality-conversion-based: it first converts MTS windows into images via MV-MTF, then feeds both the original numeric series and the converted images into a Multimodal-CNN, and finally applies a SHAP-based anomaly explainer [2510.01970].

The motivation for this dual-branch architecture is explicit. MV-MTF is intended to make “variable-to-variable and time-to-time transitions” visible as image texture, thereby highlighting structural anomalies. At the same time, the paper notes that image conversion may lose fine-grained numerical details, so the raw numeric branch is retained to preserve patterns that are not fully captured by the image representation.

The Multimodal-CNN uses two branches with parameter sharing. One branch processes the raw numeric window; the other processes the MV-MTF image. Feature extraction employs multiple convolution kernels with varying receptive fields inspired by Omni-Scale CNN, with prime-number kernel sizes and final \(1\times1\) and \(2\times2\) kernels described as covering multiple scales. Cross-modal attention is then applied in both directions:
numeric features attend to image features, and image features attend to numeric features. After branch-wise extraction and attention, the features are fused by concatenation and a depthwise separable convolution, followed by layer normalization, a gated feedforward network, global average pooling, and a fully connected layer for anomaly classification. Algorithm 1 confirms that MV-MTF is treated as one modality within a joint classifier trained with Adam [2510.01970].

The SDN intrusion-detection architecture uses a different downstream design. There, each featurewise MTF \(M_{t,l}\) enters a first Transformer module via linear projections
\[
Q_l = M_{t,l} W_Q + b_Q,\quad
K_l = M_{t,l} W_K + b_K,\quad
V_l = M_{t,l} W_V + b_V,
\]
followed by self-attention
\[
A_l = \text{softmax}\left(\frac{Q_l K_l^T}{\sqrt{d_k}}\right),
\qquad
C_{t,l} = A_l V_l.
\]
The resulting contexts are concatenated as
\[
E_t = \{C_{t,1}, C_{t,2}, \dots, C_{t,L}\},
\]
then fused with the flattened structural tensor in a second Transformer:
\[
\hat{E}_t = \{E_t, S_t\}.
\]
Classification is performed via
\[
Y_t = \text{softmax}(W_o C_t + b_o),
\]
with categorical cross-entropy loss
\[
\mathcal{L} = - \sum_{c=1}^{C} y_c \log(\hat{y}_c).
\]
This model uses MTF-derived representations as a front end for multivariate SDN traffic analysis, but the multivariate interaction mechanism resides in the Transformer and the structural tensor rather than in the MTF stage itself [2508.16035].

## 6. Empirical evidence, limitations, and reporting caveats

Moon reports that extensive experiments on six real-world MTS datasets show improvements of up to 93% in efficiency, 4% in accuracy, and 10.8% in interpretation performance over six state-of-the-art methods [2510.01970]. The ablation evidence is especially relevant to MV-MTF itself. On PSM, full Moon attains F1 \(0.9934\), compared with \(0.9652\) for “only raw data,” \(0.9898\) for “only MV-MTF data,” and \(0.9148\) when replacing MV-MTF with GAF. On SMD, the corresponding F1 values are \(0.9956\), \(0.9652\), \(0.9942\), and \(0.8597\). The paper also presents a KL-divergence comparison in Fig. 1 as qualitative evidence that MV-MTF enlarges the distribution gap between normal and abnormal data.

The SDN intrusion-detection study provides strong evidence that MTF is useful in a multivariate application even when the construction is only channelwise. On the InSDN dataset, the proposed model reports precision/F1/recall of 99.8/99.6/99.7 at 100% data accessibility, 98.5/98.2/98.3 at 80%, and 98.3/98.0/98.1 at 60%. The reported ablation gives 99.8/99.6/99.7 for the full MTF-Transformer, 95.3/94.8/94.9 without MTF, and 93.6/92.5/93.2 without Transformer. Reported training and inference times are 1200 s and 8 ms for the proposed model, compared with 900 s and 15 ms for KNN, 1100 s and 12 ms for Random Forest, 2500 s and 20 ms for LSTM, and 2800 s and 18 ms for Donut [2508.16035]. These findings support the utility of MTF-based representations for multivariate time-series classification, but they do not validate a strict MV-MTF because the MTFs remain featurewise.

Several limitations and ambiguities recur across the literature. In Moon, the candidate set of bin counts \(Q\), the operational choice of \(\omega_{u,k}\), any normalization before binning, and whether \(M_X\) is rescaled before CNN ingestion are not reported. The paper also introduces a reporting inconsistency for a parameter \(\omega\) used in the SHAP explainer, though this does not affect the core MV-MTF parameter \(\alpha = 0.9\) [2510.01970]. In the SDN paper, crucial MTF-related hyperparameters are missing, including the number of quantization bins \(Q\), initialization of adaptive boundaries \(\theta\), the Gaussian blur parameter \(\sigma\), the exact post-blur resolution, and the mapping from MTF matrices to Transformer embeddings. The manuscript also contains malformed positional encoding equations, notation inconsistencies, and an unclear embedding dimensionality statement \((\tau/Q)\times 1\) [2508.16035].

Two misconceptions are therefore best avoided. First, not every method described as “multivariate MTF-aided” is an MV-MTF in the strict mathematical sense; channelwise stacks of univariate MTFs remain standard MTFs plus downstream fusion. Second, a genuine MV-MTF need not require a single joint quantization over the full multivariate state space. Moon shows a different construction: per-variable discretization, pairwise cross-variable transition matrices, within-variable and cross-variable field fusion, and final summation into one image. Within the supplied literature, this is the clearest explicit formulation of MV-MTF proper.

Source: https://www.emergentmind.com/topics/multivariate-markov-transition-field-mv-mtf