Such an amount of connections should anyway trigger all possible logging & IDS systems, right?
Alerting is useless, with the volume of automated exploits attempted.
But people here are going to explain that fail2ban is security theater...
This is all a matter of threat and risk management. If you know what you are doing then fail2ban or portknocking is another layer on your security.
Security theater in my opinion is something else: nonsense password policies, hiding your SSID, whitelisting MACs, ...
More resourceful attackers could automate attempted exploit using a huge botnet, and it'd likely look similar to the background of ssh brute force bots that we already see 24/7/365.