Where The Wild Things Are: Brute-Force SSH Attacks In The Wild And How To Stop Them
This document was shared here by @ricci I've not gotten to study the document in detail. JUst saw it again in my download dir of my now defunct miniPC by gigabyte
Of course I will link you to his page so you can download the paper yourself. THe research covers 4 years and 500+ (512?) servers
Go to his post here read and learn.
You can learn a LOT from this research