This study looks at how traditional tools and machine learning models compare when it comes to spotting brute-force attacks onSSH servers. Tools like Fail2Ban and PAM Tally2 are commonly used, but they depend on fixed rules and often miss slow or spread-out attacks. To improve this, a machine learning model was built using real SSH login data. It focused on patterns like failed login attempts, unusual usernames, and how ports were being used. The model performed well, reaching 90% accuracy, with a precision of 0.89 and a recall of 0.97. When the same dataset was tested with Fail2Ban and PAM Tally2, these tools were able to catch aggressive attacks but also flagged more false positives and missed less obvious ones. Real examples showed that the machine learning model was better at finding tricky attack patterns while letting legitimate users log in without trouble. The results suggest that using both machine learning and traditional tools together can create a stronger, more flexible defense against brute-force attacks.