Monitoring and diagnosing (M&D) software based on requirement models is a problem that has recently received a lot of attention in field of Requirement Engineering. In this context, Wang et al. [1] propose a M&D framework that uses goal models to diagnose failures in software at different levels of granularity. In this paper we extend Wang’s framework to monitor and diagnose malicious attacks. Our extensions include the addition of anti-goals to model attacker intentions, as well as context-based modeling of the domain within which our system operates. The extended framework has been implemented and evaluated through a series of experiments intended to test its scalability.