Script for firewall autoban

Hey guys, ive been using for a while merlin, and now after some suspicious logs, im looking to do a little script that auto bans an ip for lets say 30 minutes if too many port requests are received from an ip.
any ideas how to do that?
thank you!