SECURITY DEVICE IMPLEMENTING NETWORK FLOW PREDICTION, AND FLOW OWNERSHIP ASSIGNMENT AND EVENT AGGREGATION IN A DISTRIBUTED PROCESSOR SYSTEM

A security device for processing network flows includes a predict flow table containing predict flow entries mapping predicted network flows to packet processor ownership assignments. The predict key includes multiple data fields identifying a predicted network flow where one or more of the data fields have a wildcard value. In another embodiment, a security device for processing network flows includes a packet processing manager configured to assign ownership of network flows to the one or more packet processors where the packet processing manager includes a global flow table containing entries mapping network flows to packet processor ownership assignments. In another embodiment, a security device for processing network flows includes packet processing cards with packet processors formed thereon where each packet processing card stores local counter values for one or more events and a packet processing manager including global event counters to maintain event statistics for events in the security device.