Open Access

ARTICLE

Vision-Based Frontend Extraction and LLM-Enhanced Web Honeypot Framework

Guan Yang¹, Shiyan Kang¹, Bo Chen^2,3, Yu Wang^4,*

1 School of Computer Science, Zhongyuan University of Technology, Zhengzhou, China
2 School of Mathematical Sciences, Shenzhen University, Shenzhen, China
3 Guangdong Provincial Key Laboratory of Intelligent Information Processing, Shenzhen University, Shenzhen, China
4 School of Software, Henan University of Engineering, Zhengzhou, China

* Corresponding Author: Yu Wang. Email:

Computers, Materials & Continua 2026, 89(1), 21 https://doi.org/10.32604/cmc.2026.084499

Received 23 April 2026; Accepted 15 June 2026; Issue published 13 August 2026

Abstract

Web honeypots serve as foundational technologies for active deception, attracting attackers and extracting actionable threat intelligence. To address the challenges associated with manual and labor-intensive frontend construction, this paper presents the HFG framework, a security-oriented frontend generation framework designed for the large-scale deployment of heterogeneous Web-service decoy nodes. HFG utilizes a vision-to-code architecture integrating a PVT-CoT visual encoder, multi-scale adaptive fusion, visual token compression, a visual prefix bridge, and a Qwen2-LoRA code decoder. The model is trained on WebSight-derived data and evaluated on both the WebSight-derived test set and the Design2Code benchmark. General reconstruction metrics, including Block-Match, Text, Position, Color, and CLIP, are used together with honeypot-specific metrics, namely Honeypot-Critical Component Recall and Honeypot Interaction Readiness, to assess visual fidelity, reconstruction quality, component preservation, and interaction readiness. Experimental results on Design2Code show that HFG-7B achieves competitive reconstruction performance, with 51.2 Block-Match, 77.8 Text, and 85.2 CLIP, among other metrics. Under the same 1.5B decoder scale, HFG-1.5B significantly outperforms the PVT-Qwen-1.5B baseline in honeypot-specific fidelity, improving HCCR from 0.46 to 0.68 and HIR from 0.39 to 0.57. With a larger 7B decoder, HFG-7B further improves HCCR and HIR to 0.76 and 0.64, respectively. These results demonstrate that HFG renders visually plausible interfaces while better preserving honeypot-critical components, providing a locally trainable, resource-conscious, and practical solution for generating inspectable Web honeypot frontends.

---

Keywords

---