Lot of Failed Login - May be a Hacker - Script??

Hi,

I need a script to discover continuos login attemps, put them on a list and block this attemps over SSH port.

I need that port, them I can´t block them

Then, the list, like port scanners, could be actualized and blocked by ip src addres during a period of time.

Any idea or knoledge base in order to develope a script?

Thx in advance