Alternatively or in addition, add a firewall rule to permanently ban any IPs after too many failed attempts or simultaneous connections, make sure root login is disabled, and/or put sshd on a non-standard port (I find the last one a bit of security theater, but it will reduce some wasted traffic if nothing else.) Here's my pf rule for ssh (brute force filter):

    table <sshbans> persist
    block quick from <sshbans>
    pass quick proto tcp from any to any port ssh \
      flags S/SA keep state \
      (max-src-conn 15, max-src-conn-rate 5/3, \
      overload <sshbans> flush global)

Raise the values a bit if you have other SSH users on your box.

I get about 50 new bans a day. It's pretty much guaranteed if you have a server on the web with port 22 open, that bots will be attempting to brute-force it.