1. A security device for processing a plurality of network flows, comprising: one or more packet processors configured to receive incoming data packets associated with one or more network flows, at least one of the packet processors being assigned as an owner of one or more network flows, and each packet processor processing data packets associated with flows for which it is the assigned owner and each network flow being assigned to only one owner packet processor, each owner packet processor processing data packets associated with a network flow to enforce a security policy; and a packet processing manager configured to assign ownership of network flows to the one or more packet processors, the packet processing manager comprising a global flow table containing global flow table entries mapping network flows to packet processor ownership assignments and a predict flow table containing predict flow entries mapping predicted network flows to packet processor ownership assignments, wherein each predict flow entry comprises a predict key identifying in part a predicted network flow being a child flow corresponding to a parent flow in a connection session, the child flow being derived from information relating to the parent flow, and a packet processor ownership assignment associated with the parent flow corresponding to the child flow, the predict key comprising a plurality of data fields identifying the predicted network flow where the value of one or more of the data fields is unknown; and wherein in response to a first packet processor receiving data packets associated with a first parent flow for a connection session that indicates a first child flow to be determined, the packet processing manager adds a first predict flow entry in the predict flow table, the first predict flow entry includes a predict key identifying the first child flow as the predicted network flow with the value of one or more of the data fields in the predict key having wildcard values, the first predict flow entry mapping the predicted network flow to the packet processor assigned as the owner of the first parent flow so that the packet processor assigned as the owner of the first parent flow is also assigned to process data packets associated with the first child flow associated with the first parent flow; and wherein in response to a second data packet being forwarded to the packet processing manager and in response to the network flow for the second data packet being found in the predict flow table, the packet processing manager adds an entry in the global flow table to identify the first packet processor as the owner packet processor of the second data packet; and in response to receiving a message from the owner packet processor indicating acceptance of the ownership assignment, the packet processing manager stores a binding entry in the global flow table mapping the network flow to the owner packet processor.