{"type":"ScholarlyArticle","title":"MA-RAG: Automating Role Engineering for RESTful APIs with Multi-Head Attention and Retrieval-Augmented Generation","authors":[{"name":"Yang Luo","slug":"yang-luo","given":"Yang","family":"Luo","affiliation":""},{"name":"Qingni Shen","slug":"qingni-shen","given":"Qingni","family":"Shen","affiliation":""},{"name":"Zhonghai Wu","slug":"zhonghai-wu","given":"Zhonghai","family":"Wu","affiliation":""}],"abstract":"This paper addresses the role engineering problem for RESTful applications and proposes a role engineering method based on multi-head attention and Retrieval Augmented Generation called MA-RAG. The method first performs fine-grained control flow analysis on the system source code to extract permission information of API handlers. Then, using basic blocks as units, it employs pre-trained code models to convert the source code into semantic vectors, which are stored in the retrieval augmented generation model. On this basis, a call chain structure tree is constructed with permissions as the center, utilizing the multi-head attention mechanism to aggregate semantic information of different code granularities from bottom to top, with each attention head corresponding to a role engineering objective. Finally, the root vectors of each permission tree are subjected to self-supervised clustering to adaptively determine the number of roles and perform division. We evaluated MA-RAG on 284 real-world software systems, and the results show that compared with other methods, MA-RAG can significantly save time overhead, reduce the number of generated roles, lower the role permission overlap rate, and improve the interpretability score.","doi":"10.24963/ijcai.2025/846","url":"https://ijcai.org/proceedings/2025/846","pdf":"https://ijcai.org/proceedings/2025/0846.pdf","markdown":"https://ijcai.org/proceedings/2025/846.md","bibtex":"https://ijcai.org/proceedings/2025/bibtex/846","volume":{"slug":"2025","title":"Proceedings of the Thirty-Fourth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2025","url":"https://ijcai.org/proceedings/2025/","year":2025,"location":"Montreal, Canada","dates":"16-22 August 2025","editors":"James Kwok","isbn":"978-1-956792-06-5","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2025"},"section":"Multidisciplinary Topics and Applications","track":"Main Track","number":846,"pages":{"first":7607,"last":7615},"keywords":["Data Mining: DM: Mining codebase and software repositories","Natural Language Processing: NLP: Language models","Multidisciplinary Topics and Applications: MTA: Software engineering","Multidisciplinary Topics and Applications: MTA: Security and privacy"],"videos":[],"references":[],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}