1. A security device for processing a plurality of network flows, comprising: one or more packet processors configured to receive incoming data packets associated with one or more network flows, at least one of the packet processors being assigned as an owner of one or more network flows, and each packet processor processing data packets associated with flows for which it is the assigned owner and each network flow being assigned to only one owner packet processor, each owner packet processor processing data packets associated with a network flow to enforce a security policy; and a packet processing manager configured to assign ownership of network flows to the one or more packet processors, the packet processing manager comprising a global flow table containing global flow table entries mapping network flows to owner packet processors and a predict flow table containing predict flow entries mapping predicted network flows to the owner packet processors assigned to parent flows for connection sessions that indicate child flows to be determined, wherein in response to a first data packet being received by one of the one or more packet processors and being associated with a first parent flow for a connection session that indicates a first child flow to be determined, the packet processing manager adds a first predict flow entry in the predict flow table, the first predict flow entry mapping a predicted network flow to the packet processor assigned as the owner of the first parent flow, and in response to a second data packet being received by one of the one or more packet processors and the network flow for the second data packet being found in the predict flow table as matching the first predict flow entry, the packet processing manager adds an entry in the global flow table to map the network flow of the second data packet to the owner packet processor of the first parent flow; and in response to receiving a message from the owner packet processor indicating acceptance of the ownership assignment, the packet processing manager stores a binding entry in the global flow table mapping the network flow of the second data packet to the owner packet processor of the first parent flow.