Vision-Based Frontend Extraction and LLM-Enhanced Web Honeypot Framework

Web honeypots serve as foundational technologies for active deception, attracting attackers and extracting actionable threat intelligence. To address the challenges associated with manual and labor-intensive frontend construction, this paper presents the HFG framework, a security-oriented frontend generation framework designed for the large-scale deployment of heterogeneous Web-service decoy nodes. HFG utilizes a vision-to-code architecture integrating a PVT-CoT visual encoder, multi-scale adaptive fusion, visual token compression, a visual prefix bridge, and a Qwen2-LoRA code decoder. The model is trained on WebSight-derived data and evaluated on both the WebSight-derived test set and the Design2Code benchmark. General reconstruction metrics, including Block-Match, Text, Position, Color, and CLIP, are used together with honeypot-specific metrics, namely Honeypot-Critical Component Recall and Honeypot Interaction Readiness, to assess visual fidelity, reconstruction quality, component preservation, and interaction readiness. Experimental results on Design2Code show that HFG-7B achieves competitive reconstruction performance, with 51.2 Block-Match, 77.8 Text, and 85.2 CLIP, among other metrics. Under the same 1.5B decoder scale, HFG-1.5B significantly outperforms the PVT-Qwen-1.5B baseline in honeypot-specific fidelity, improving HCCR from 0.46 to 0.68 and HIR from 0.39 to 0.57. With a larger 7B decoder, HFG-7B further improves HCCR and HIR to 0.76 and 0.64, respectively. These results demonstrate that HFG renders visually plausible interfaces while better preserving honeypot-critical components, providing a locally trainable, resource-conscious, and practical solution for generating inspectable Web honeypot frontends.