There are lots of places to learn about 2 and 3, not sure about 1 because I'm not a dev, but something I find almost nothing about anywhere is the process of re

There are lots of places to learn about 2 and 3, not sure about 1 because I'm not a dev, but something I find almost nothing about anywhere is the process of reverse engineering custom binary network protocols used by backdoors or how to identify such a protocol is present while analyzing network traffic. Some people can search through a bunch of PCAP and once in a while they find a backdoor no one has ever seen. I know a few people like this and none of them can explain it well. Note: I'm aware that a lot of these protocols are reversed and discovered by using a malware sample found on a compromised host. Those aren't the situations I'm talking about. Also, there are dozens if not hundreds of resources for network flow analysis, but almost all of them are too shallow to be useful. They explain what netflow is, tell you how to collect them, mention the names of the tools used to analyze them, and then provide no actual information on the analysis process.