Standard response to SSH "bruteforcing" articles: use SPA or port knocking to hide sshd. Use key-based auth and disable passwords/root login. Use the AllowUsers setting to restrict which accounts can login.