Re-route the incoming attack back to the host. As each new "subnet" pops up, apply the same method. SSH port listening block incomeing originating brute force IP and netbios as well as mac address. Utimately "black holing" the offending hardware.