Possible Vulnerability in DataNodes via SSH

I suspected something weird in my Hadoop cluster. When I run datanodes, after a while my servers(except namenode) will be down for SSH Max Attempts. When I checked the 'systemctl status ssh', I figured out there are some invalid username/password attempts via SSH and the SSH daemon blocked all incoming connections and I got connection refused.

I have no problem when my datanodes are not running.