I too struggle with patterns so I do what I know....code. It is completely up to your requirements but one solution could include the use of two SSN fields, one for display and one for data binding. In the attached form I use a regular expression to parse "ssn_" and validate it complies with the format 123456789 or 123-45-6789. If it does I rebuild "ssn_" with the mask and the last 4 digits then assign the value entered to the field "ssn". The field "ssn_" is set to use "No data binding" and "ssn" is set to "Use name (ssn)". In the attached "snn" is visible for demonstration but it would be declared hidden.
Steve