This is how I would do it.
Craft a cookie that expires, say, in 30 minutes (i.e., a non-persistent
cookie that times out later than a session cookie).
If your Session_start even handler, look for this cookie. If it is present,
then it indicates that user has timed out, but haven't closed the browser.
If the cookie doesn't exist, either it is because the user has not posted
back for 30 mins or the user closed browser (which would remove a
non-persistent cookie).
I guess you just have to determine what is an optimum time for the cookie
expiry time in order to distinguish between time-out vs browser closing.
HTH