A security device for processing a plurality of network flows, comprising: one or more packet processors configured to receive incoming data packets associated with one or more network flows, at least one of the packet processors being assigned as an owner of one or more network flows, and each packet processor processing data packets associated with flows for which it is the assigned owner; and a packet processing manager configured to assign ownership of network flows to the one or more packet processors, the packet processing manager comprising a global flow table containing global flow table entries mapping network flows to packet processor ownership assignments and a predict flow table containing predict flow entries mapping predicted network flows to packet processor ownership assignments, wherein each predict flow entry comprises a predict key identifying a predicted network flow being a child flow corresponding to a parent flow in a connection session, and a packet processor ownership assignment associated with the parent flow corresponding to the child flow, the predict key comprising a plurality of data fields identifying the predicted network flow where the value of one or more of the data fields is unknown; and wherein in response to a first data packet being received by one of the one or more packet processors and being associated with a first parent flow for a connection session that indicates a first child flow to be determined, the packet processing manager adds a first predict flow entry in the predict flow table, the first predict flow entry includes a first predict key identifying the first child flow as the predicted network flow with the value of one or more of the data fields in the predict key having wildcard values, the first predict flow entry mapping the predicted network flow to a first packet processor assigned as the owner of the first parent flow so that the first packet processor assigned as the owner of the first parent flow in the predict flow table is also assigned to process data packets associated with the first child flow associated with the first parent flow; and in response to a second data packet, associated with the first child flow, being received by one of the one or more packet processors and the network flow for the second data packet being found in the predict flow table by matching flow information of the second data packet to the one or more predict keys in the predict flow table, the packet processing manager adds an entry in the global flow table to map the network flow of the second data packet to the first packet processor, assigned as the owner of the first parent flow, also as the owner of the first child flow. one or more packet processors configured to receive incoming data packets associated with one or more network flows, at least one of the packet processors being assigned as an owner of one or more network flows, and each packet processor processing data packets associated with flows for which it is the assigned owner; and a packet processing manager configured to assign ownership of network flows to the one or more packet processors, the packet processing manager comprising a global flow table containing global flow table entries mapping network flows to packet processor ownership assignments and a predict flow table containing predict flow entries mapping predicted network flows to packet processor ownership assignments, wherein each predict flow entry comprises a predict key identifying a predicted network flow being a child flow corresponding to a parent flow in a connection session, and a packet processor ownership assignment associated with the parent flow corresponding to the child flow, the predict key comprising a plurality of data fields identifying the predicted network flow where the value of one or more of the data fields is unknown; and wherein in response to a first data packet being received by one of the one or more packet processors and being associated with a first parent flow for a connection session that indicates a first child flow to be determined, the packet processing manager adds a first predict flow entry in the predict flow table, the first predict flow entry includes a first predict key identifying the first child flow as the predicted network flow with the value of one or more of the data fields in the predict key having wildcard values, the first predict flow entry mapping the predicted network flow to a first packet processor assigned as the owner of the first parent flow so that the first packet processor assigned as the owner of the first parent flow in the predict flow table is also assigned to process data packets associated with the first child flow associated with the first parent flow; and in response to a second data packet, associated with the first child flow, being received by one of the one or more packet processors and the network flow for the second data packet being found in the predict flow table by matching flow information of the second data packet to the one or more predict keys in the predict flow table, the packet processing manager adds an entry in the global flow table to map the network flow of the second data packet to the first packet processor, assigned as the owner of the first parent flow, also as the owner of the first child flow.