There is a guide how to protect password brute force over SSH, which is the most attacked https://medium.com/@bnay14/installing-and-configuring-fail2ban-to-secure-ssh-1e4e56324b19
But I also recommend you to change the SSH port to another, is simple and pretty effective as all those bots are always using the default port and not doing a deep scan.
Oh well, I only run services on my cloud, so I need to get SSH to manage them. hehehe 😄