The embodiment of invention provides a method and a device for controlling security sandbox, relates to the field of network security, and can enhance analysis efficiency of the security sandbox.. The method comprises the steps that a control device of the security sandbox acquires control information which includes a first control command and configuration parameters, the first control command is used for ordering the security sandbox to generate a first virtual machine with the designated operating system, the configuration parameters are used for modifying the system parameters of the operating system; the control device generates the first virtual machine with the designated operating system according to the first control command; the control device modifies the system parameters of the designated operating system according to the configuration parameters to let the specified operating system with modified parameters to form a simulated operating environment, and the simulated operating environment is used for running the program to be monitored.