is it a service that is required to be open to everyone? eg. if you're in the USA, and its for employees to do remote desktop, then you could block foreign ip's to that port (set of ports) if its supposed to be open for people to connect to, then your only real option is to block individual ip's that become abusive. Alternatively you can work with IDS & IPS on your perimeter to have them stopped at the edges based on their actions. You would set reasonable limits.. 5 attempts in a short period of time might be ok, but 10 in that same time frame would indicate attack. etc..