The Internet of things (IoT), including power meters, water meters, natural gas meters, and meter collectors in an open metering system (OMS), which is dispersed around the user side, relies on wireless virtual private networks (VPNs) to communicate with head end, and thus it is exposed to malicious cyber attacks. The General Packet Radio Service (GPRS), which is vulnerable to rogue femtocells, is widely used for communication among meter collectors and the head end. Because telecommunication fraud related to rogue femtocells is a serious offence, rogue femtocells will be turned on for some time and immediately turned off and moved from here to there to escape from being caught. The signal strength (SS) of rogue femtocells is characterized by abrupt changes. Because meter collectors and lawful femtocells are deployed at the fixed location, there is a notable difference between signal strength profile of lawful and rogue femtocells. Prior knowledge of variation of signal strength is utilized to formulate rules to detect rogue femtocells. An expert system is developed to detect rogue femtocells and prevent meter collectors from attaching to them. Numerical simulation indicates that the proposed approach can detect both stationary and moving rogue femtocells online. Since computation load of the proposed approach is not high, it can be implemented in existing IoT meter collectors with limited computation resource and the proposed approach can harden cyber security of OMS.